2026-10-30_91d45d2a289bd92694bde3d70beb5ab4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_91d45d2a289bd92694bde3d70beb5ab4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 5.3MB
Sample261030-11ldcafv2w
SHA256 c4db2305033eab4c645c2dbb761e50cbf666d4f35faf74b6f9187585992c3bf6
MD5 91d45d2a289bd92694bde3d70beb5ab4
SHA1 afe7de5ac5ae978289fd827ec1e9050ce8b9f8bc
SHA512 802694d07c61640ce484c0ed982d23f29ed18ef7f35899738b8b1842764bb3752f538b2100dc0384bddda4888e0c84c4f51e73f6d4128046f6a15d194e93751f
SSDEEP 49152:K+sJ/OJ3gpOCYW79efpjgw62UMv+bdE5dx2W830YG0ButRzynFQQten5UZZLN/Yx:KDd2UeUGdR0tXZLN/XCfK/rC
TLSH
T15046CF03F3A651ECD127D078C956931BEBB2B819272157DB23D91A26EF236E04E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_91d45d2a289bd92694bde3d70beb5ab4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-30_91d45d2a289bd92694bde3d70beb5ab4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 5.3MB

2026-10-30_91d45d2a289bd92694bde3d70beb5ab4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH baac39a3d5262869b1ba9d6ab8021da0
SHA256 c4db2305033eab4c645c2dbb761e50cbf666d4f35faf74b6f9187585992c3bf6
MD5 91d45d2a289bd92694bde3d70beb5ab4
SHA1 afe7de5ac5ae978289fd827ec1e9050ce8b9f8bc
SHA512 802694d07c61640ce484c0ed982d23f29ed18ef7f35899738b8b1842764bb3752f538b2100dc0384bddda4888e0c84c4f51e73f6d4128046f6a15d194e93751f
SSDEEP 49152:K+sJ/OJ3gpOCYW79efpjgw62UMv+bdE5dx2W830YG0ButRzynFQQten5UZZLN/Yx:KDd2UeUGdR0tXZLN/XCfK/rC
TLSH
T15046CF03F3A651ECD127D078C956931BEBB2B819272157DB23D91A26EF236E04E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1396192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Documents\GitHub\cs2-external\Build\ReleaseTest\Cheat.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

secureenginesdk64

ord104 ord504

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSACleanup WSAStartup WSAGetLastError setsockopt ioctlsocket freeaddrinfo getsockopt WSARecv connect getaddrinfo WSASocketW WSASetLastError shutdown select WSASend closesocket WSAIoctl

advapi32

OpenProcessToken RevertToSelf SetTokenInformation SetThreadToken DuplicateTokenEx GetTokenInformation PrivilegeCheck LookupPrivilegeValueW CreateProcessAsUserW

kernel32

SetUnhandledExceptionFilter LocalFree FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency CloseHandle CreateToolhelp32Snapshot Process32FirstW lstrcmpiW Process32NextW GetModuleFileNameW WaitForSingleObject CreateWaitableTimerExW SetWaitableTimerEx OpenProcess GetStartupInfoW GetCommandLineW ExitProcess GetModuleHandleW LoadLibraryA GetProcAddress HeapFree EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSectionEx HeapSize PostQueuedCompletionStatus SetEvent TerminateThread GetCurrentProcess HeapReAlloc HeapAlloc QueueUserAPC DecodePointer DeleteCriticalSection GetProcessHeap TlsFree GetCurrentThread GetLastError GetModuleHandleExA GetModuleFileNameA WriteConsoleW SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation FlushFileBuffers GetFileSizeEx GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType GetStdHandle IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter ReadFile GetModuleHandleExW FreeLibraryAndExitThread CreateFileA CreateFileMappingA TlsAlloc GetTickCount64 ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedPushEntrySList GetSystemTimeAsFileTime InitializeSListHead GetCPInfo GetStringTypeW LCMapStringEx EncodePointer WakeConditionVariable GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte FreeLibrary GetLocaleInfoA TryEnterCriticalSection InitializeCriticalSection OpenEventW OpenFileMappingW UnmapViewOfFile Sleep GetCurrentProcessId MapViewOfFile SetWaitableTimer TlsSetValue SetLastError InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateEventW SleepEx TlsGetValue CreateIoCompletionPort WriteFile CreateFileW IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW

user32

OpenClipboard GetCursorPos EnumDisplaySettingsW CloseClipboard RegisterClassExW GetSystemMetrics CreateWindowExW UnregisterClassW SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent LoadCursorW SetForegroundWindow SetLayeredWindowAttributes DefWindowProcW FindWindowExW GetWindowTextW MessageBoxA LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos ReleaseDC GetDC IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState ShowWindow GetWindowThreadProcessId GetForegroundWindow DispatchMessageW TranslateMessage PeekMessageW SetWindowDisplayAffinity SetWindowLongW GetWindowLongW MoveWindow MapWindowPoints GetClientRect IsWindow GetMonitorInfoA EnumDisplayMonitors UpdateWindow DestroyWindow GetMessageExtraInfo

ole32

CoUninitialize CoCreateInstance CoInitializeEx

dbghelp

SymFromAddr SymInitialize StackWalk64 SymGetModuleBase64 SymFunctionTableAccess64 SymSetOptions SymCleanup

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlCaptureContext RtlUnwind

gdi32

DeleteDC SelectObject DeleteObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits StretchBlt

shell32

ShellExecuteW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_91d45d2a289bd92694bde3d70beb5ab4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

secureenginesdk64

dwmapi

ws2_32

advapi32

kernel32

user32

ole32

dbghelp

imm32

api-ms-win-core-synch-l1-2-0

ntdll

gdi32

shell32

bcrypt

generic