2026-10-28_95152a7e6885bae0b47f49f2bafa33f8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_95152a7e6885bae0b47f49f2bafa33f8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 11.5MB
Sample261029-285mmatz3k
SHA256 abf0e30ed3b219f56ecb3f6f8ef8e38ce82b43fea5f227e18fe31d26d5a0549a
MD5 95152a7e6885bae0b47f49f2bafa33f8
SHA1 3f43723ce2515d0638361c47e629233dc608148d
SHA512 49b05a2145643e52e7d63cb98aba76992247abce2471a8f815ce90dd43e1a00f28c228a128584b7d8d4df24c4d75c3de507d9759c32a3e5d14558104d5a53b02
SSDEEP 196608:9pnWWws7dXgm1hlYjjog11+Ix4C80wt15bhdvPL3FRTZ8t4Vq5l7cr7a:LJws7dXgm1hlYjj511+Ix4C80wt1rdvY
TLSH
T1F2C6AE42B69250E9D62B8034C8929357E7717C190BA25AE73668B7ED3F377E13A37700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_95152a7e6885bae0b47f49f2bafa33f8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-28_95152a7e6885bae0b47f49f2bafa33f8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 11.5MB

2026-10-28_95152a7e6885bae0b47f49f2bafa33f8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH ec350d7eac133c435b9a11d37306b033
SHA256 abf0e30ed3b219f56ecb3f6f8ef8e38ce82b43fea5f227e18fe31d26d5a0549a
MD5 95152a7e6885bae0b47f49f2bafa33f8
SHA1 3f43723ce2515d0638361c47e629233dc608148d
SHA512 49b05a2145643e52e7d63cb98aba76992247abce2471a8f815ce90dd43e1a00f28c228a128584b7d8d4df24c4d75c3de507d9759c32a3e5d14558104d5a53b02
SSDEEP 196608:9pnWWws7dXgm1hlYjjog11+Ix4C80wt15bhdvPL3FRTZ8t4Vq5l7cr7a:LJws7dXgm1hlYjj511+Ix4C80wt1rdvY
TLSH
T1F2C6AE42B69250E9D62B8034C8929357E7717C190BA25AE73668B7ED3F377E13A37700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5277920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Alex\Desktop\Dock\bin\x64\Release\Dock.pdb

user32

AllowSetForegroundWindow GetKeyState DefWindowProcW GetWindowThreadProcessId SetForegroundWindow SetRect UpdateLayeredWindow SetRectEmpty SetFocus IntersectRect IsRectEmpty GetMessageTime UnionRect ReleaseDC UpdateLayeredWindowIndirect GetDC DispatchMessageW DestroyIcon GetIconInfo CharUpperW IsIconic GetClassNameW SwitchToThisWindow IsWindow CharLowerW MonitorFromPoint GetWindowLongW EnumDisplaySettingsW MonitorFromWindow GetWindow FindWindowExW DestroyWindow GetAsyncKeyState IsWindowVisible SetWindowPos SetWindowLongPtrW EnumDisplayMonitors CreateWindowExW CallNextHookEx GetWindowLongPtrW RegisterClassExW GetGuiResources AppendMenuW DestroyMenu SetMenuDefaultItem TrackPopupMenu CreatePopupMenu CheckMenuRadioItem PostThreadMessageW MsgWaitForMultipleObjects GetCapture GetSystemMetrics TrackPopupMenuEx EnableWindow LoadImageW IsClipboardFormatAvailable ShowWindow SetTimer GetMonitorInfoW PeekMessageW MsgWaitForMultipleObjectsEx TrackMouseEvent GetForegroundWindow UnhookWindowsHookEx PostMessageW GetWindowTextLengthW EnumWindows TranslateMessage MessageBoxW FindWindowW LoadCursorW SetCapture SetWindowsHookExW SetCursor KillTimer PostQuitMessage ReleaseCapture InflateRect SystemParametersInfoA wsprintfW GetSystemMetricsForDpi UnregisterHotKey RegisterHotKey RegisterClipboardFormatW RemoveClipboardFormatListener AddClipboardFormatListener CallWindowProcW FillRect SetWindowTextW MoveWindow SetLayeredWindowAttributes GetClientRect GetWindowTextW ExitWindowsEx LockWorkStation MessageBeep GetWindowRect GetDpiForWindow ScreenToClient SendMessageW OpenClipboard CloseClipboard EmptyClipboard IsWindowEnabled GetClipboardData SetClipboardData GetCursorPos

gdi32

SaveDC RestoreDC GetGlyphIndicesW GetFontUnicodeRanges GetOutlineTextMetricsA GetGlyphOutlineW SetTextAlign GetCharWidth32A CreateFontIndirectW BitBlt CreateSolidBrush GetTextMetricsA SetWorldTransform SetBkMode ExtTextOutW CreateCompatibleBitmap CreateRectRgn ExtCreateRegion GetClipBox GetClipRgn GetGraphicsMode IntersectClipRect SelectClipRgn ExtSelectClipRgn GetWorldTransform GdiFlush SetGraphicsMode ModifyWorldTransform SetMapMode GetDeviceCaps StretchDIBits GetDIBits GetObjectW CreateDCA GetGlyphOutlineA GetFontData SelectObject CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject CreateFontW SetTextColor SetBkColor

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

shell32

ord6 ord155 SHQueryRecycleBinW SHParseDisplayName ord190 SHGetStockIconInfo SHGetFileInfoW SHCreateItemFromParsingName ord727 SHQueryUserNotificationState SHOpenFolderAndSelectItems ShellExecuteExW SHGetFolderPathW SHGetKnownFolderPath SHEmptyRecycleBinW ord176 DragQueryFileW ord88 DragFinish SHFileOperationW SHBindToParent ShellExecuteW CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance RegisterDragDrop ReleaseStgMedium RevokeDragDrop OleUninitialize OleInitialize

comctl32

ord381 InitCommonControlsEx

comdlg32

GetOpenFileNameW

advapi32

CryptCreateHash CryptReleaseContext CryptAcquireContextW RegLoadMUIStringW CryptHashData CryptDestroyHash LookupPrivilegeValueA RegEnumValueW CryptGetHashParam StartTraceW ProcessTrace CloseTrace CloseServiceHandle OpenSCManagerW EnumServicesStatusExW ControlTraceW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenTraceW EnableTraceEx2 LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegGetValueW

dwmapi

DwmSetWindowAttribute DwmGetColorizationColor DwmGetWindowAttribute

shlwapi

ord487 PathCombineW PathRemoveFileSpecW PathIsRootW PathCanonicalizeW PathIsUNCW PathFindExtensionW PathRemoveBackslashW StrCmpLogicalW PathFindFileNameW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

iphlpapi

if_nametoindex FreeMibTable GetIfTable2

crypt32

CryptUnprotectData CryptProtectData CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFindCertificateInStore

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents recv WSASetEvent WSAStartup WSACleanup ioctlsocket closesocket WSASocketW WSADuplicateSocketW select WSAResetEvent WSAGetLastError getsockopt WSAEventSelect socket WSAWaitForMultipleEvents ntohl gethostname sendto recvfrom listen htonl freeaddrinfo getaddrinfo __WSAFDIsSet WSAIoctl accept WSASetLastError setsockopt ntohs htons getsockname getpeername connect bind

winmm

timeEndPeriod timeBeginPeriod PlaySoundW

d2d1

ord1

powrprof

PowerGetActiveScheme GetPwrCapabilities PowerSetActiveScheme PowerReadFriendlyName PowerEnumerate SetSuspendState

pdh

PdhOpenQueryW PdhGetFormattedCounterArrayW PdhCloseQuery PdhAddEnglishCounterW PdhCollectQueryData PdhGetFormattedCounterValue

dxgi

CreateDXGIFactory1

kernel32

GetShortPathNameW OutputDebugStringA DuplicateHandle AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateProcessW GetExitCodeProcess GetConsoleOutputCP TlsFree TlsSetValue TlsGetValue TlsAlloc ResumeThread GetThreadPriority SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared InitializeSRWLock RaiseException GetModuleHandleExW VirtualQuery GetSystemDirectoryW DebugBreak SetLastError SetEnvironmentVariableW GetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW TerminateProcess SetConsoleMode GetConsoleMode GetFileInformationByHandleEx IsDebuggerPresent GetLocaleInfoW GetThreadLocale AllocConsole AttachConsole UnhandledExceptionFilter SetFilePointerEx GetCPInfo RemoveDirectoryW GetFileAttributesExW SetFileAttributesW FlushFileBuffers ReadConsoleW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetNumberOfConsoleInputEvents WriteConsoleW GetFileType GetProcessHeap HeapFree HeapReAlloc HeapAlloc CreateFileA GetLongPathNameA PeekConsoleInputA CreateFileMappingA GetFullPathNameA LoadLibraryA GetModuleHandleA GetWindowsDirectoryA GetTempPathA GetModuleFileNameA LoadLibraryW QueueUserWorkItem TerminateThread SignalObjectAndWait CreateEventA GetVersionExA GetTimeZoneInformation GetDateFormatW RtlVirtualUnwind GetStdHandle GetTimeFormatW GetCurrentDirectoryW PeekNamedPipe InitOnceComplete InitOnceBeginInitialize TryEnterCriticalSection ResetEvent ReadConsoleInputW PeekConsoleInputW GetFileInformationByHandle DeviceIoControl GetACP WaitForSingleObjectEx WaitForMultipleObjectsEx WaitForMultipleObjects CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork GetLocaleInfoA EnumSystemLocalesA VerSetConditionMask VerifyVersionInfoW SleepEx InitializeCriticalSectionEx GetCommandLineW CreateMutexW GetTickCount64 GetLastError QueryPerformanceFrequency CloseHandle LocalFree GetCurrentProcessId QueryPerformanceCounter lstrcmpW GetProcAddress GetModuleHandleW WideCharToMultiByte lstrcpynW ExpandEnvironmentStringsW GetFileAttributesW ReadFile SizeofResource GetFileSizeEx GetFullPathNameW GetPrivateProfileIntW EnumResourceNamesW CreateFileW MultiByteToWideChar GetPrivateProfileStringW LockResource LoadResource FindResourceW FreeLibrary LoadLibraryExW OpenProcess lstrcatW CreateThread QueryFullProcessImageNameW CreateDirectoryW WriteFile GetModuleFileNameW DeleteFileW MoveFileExW CopyFileW lstrcpyW CompareStringOrdinal GetLocaleInfoEx GetNumberFormatEx GetCurrentProcess K32GetProcessMemoryInfo GetSystemTimeAsFileTime GetProcessHandleCount GetProcessTimes GetVolumePathNameW GetCurrentThreadId GlobalSize GlobalAlloc GlobalFree CancelIoEx ReadDirectoryChangesW GlobalLock lstrcmpiW GlobalUnlock FindFirstFileW FindNextFileW FindClose lstrlenW FileTimeToSystemTime FindNLSStringEx GetLocalTime SystemTimeToFileTime GetSystemTime lstrcpynA GetSystemPowerStatus GetVolumeInformationW GetLogicalDrives CreateMutexA SetThreadErrorMode GetSystemWindowsDirectoryW GetDriveTypeW GetSystemTimes GetSystemInfo GlobalMemoryStatusEx WaitForSingleObject OpenFileMappingW UnmapViewOfFile Sleep CreateFileMappingW MapViewOfFile GetUserDefaultLocaleName GetTimeFormatEx GetDateFormatEx GetWindowsDirectoryW ReleaseSRWLockExclusive AcquireSRWLockExclusive CompareFileTime FindFirstFileExW EnterCriticalSection SetThreadPriority LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent GetCurrentThread DeleteCriticalSection GetStringTypeW IsValidCodePage GetOEMCP GetEnvironmentVariableA SleepConditionVariableCS FormatMessageA SwitchToThread GetCurrentProcessorNumber VirtualAlloc VirtualProtect VirtualFree GetModuleHandleExA WriteConsoleA GetConsoleScreenBufferInfo InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlUnwind FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer SetStdHandle IsProcessorFeaturePresent SystemTimeToTzSpecificLocalTime ExitProcess ExitThread FreeLibraryAndExitThread SetEndOfFile RtlCaptureContext FormatMessageW GetCommandLineA GetFileSize ReleaseMutex GetFileAttributesExA GetDiskFreeSpaceExW

msimg32

AlphaBlend

secur32

InitSecurityInterfaceW

bcrypt

BCryptGenRandom

dwrite

DWriteCreateFactory

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

329KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

301KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=36, id=259, version=33145,

count=19, id=253, version=35721,

count=12, id=259, version=35721,

count=20, id=260, version=35721,

count=56, id=261, version=35721,

count=27, productName=Unmarked objects (old),

count=1, id=259, version=36260,

count=147, id=261, version=36260,

count=743, id=260, version=36260,

count=228, id=261, version=33145,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=56, id=260, version=33145,

count=1, id=262, version=33145,

count=49, id=257, version=33145,

count=590, id=1, productName=Unmarked objects,

count=57, id=264, version=36260,

count=1, id=256, version=36260,

count=1, id=255, version=36260,

count=1, id=151,

count=1, id=258, version=36260,