2026-10-30_ed7b7f8d5f23ba14fbc8cc4599a3e5c3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_ed7b7f8d5f23ba14fbc8cc4599a3e5c3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.9MB
Sample261030-qs1sysdy7j
SHA256 2e9d17b25db87170d627448aa9820bfb2061296a7a02a13aea8b58e234387b30
MD5 ed7b7f8d5f23ba14fbc8cc4599a3e5c3
SHA1 a49fa785c44cefde86a431692617bcc0862043cc
SHA512 88d7100fc5a7acf12517868d0b05a6805abb54a6d75c170c1f20d8d0184d212632201b9c426bf62b2ae1cfd631903ea730497178675a234c76067e6af93c9f51
SSDEEP 49152:QbTee5FytPJgJaGuw3DwxGsYH++ac++jmWSvbEb/GG3tzVW6iN+Lbxz6u9s8uHXt:QCJkBpzH7vSvbEb/GG3tzZOJHd
TLSH
T17DE58E1672AC01E9E177C17889964603F7B278851336DBDF06A0DA6A2F33AE15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-30_ed7b7f8d5f23ba14fbc8cc4599a3e5c3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.9MB

2026-10-30_ed7b7f8d5f23ba14fbc8cc4599a3e5c3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH fdae69b57625fa72feed1375bf9589f0
SHA256 2e9d17b25db87170d627448aa9820bfb2061296a7a02a13aea8b58e234387b30
MD5 ed7b7f8d5f23ba14fbc8cc4599a3e5c3
SHA1 a49fa785c44cefde86a431692617bcc0862043cc
SHA512 88d7100fc5a7acf12517868d0b05a6805abb54a6d75c170c1f20d8d0184d212632201b9c426bf62b2ae1cfd631903ea730497178675a234c76067e6af93c9f51
SSDEEP 49152:QbTee5FytPJgJaGuw3DwxGsYH++ac++jmWSvbEb/GG3tzVW6iN+Lbxz6u9s8uHXt:QCJkBpzH7vSvbEb/GG3tzZOJHd
TLSH
T17DE58E1672AC01E9E177C17889964603F7B278851336DBDF06A0DA6A2F33AE15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1b:e3:b2:f4:57:dd:b9:2d:c0:a5:0c:18:66:d7:ba:a5:73:91:4c:5f:fc:66:2d:82:e9:6b:67:66:28:9d:b0:ec

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=60 159 777 492,CN=MysticCoder Pty Ltd,O=MysticCoder Pty Ltd,ST=Queensland,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Oct 25, 2026

SERIALNUMBER=60 159 777 492,CN=MysticCoder Pty Ltd,O=MysticCoder Pty Ltd,ST=Queensland,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=60 159 777 492,CN=MysticCoder Pty Ltd,O=MysticCoder Pty Ltd,ST=Queensland,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=60 159 777 492,CN=MysticCoder Pty Ltd,O=MysticCoder Pty Ltd,ST=Queensland,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

d6:d6:1e:ae:fe:1f:c4:42:8b:33:8f:48:2c:b5:fc:80

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2026 - Feb 10, 2029

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

861584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\MysticThumbs\x64\Release\MysticThumbs.pdb

kernel32

InitializeCriticalSection CreateEventA SetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessA GetVersion CopyFileW SleepEx GetEnvironmentVariableA InitializeConditionVariable VerifyVersionInfoW PeekNamedPipe SleepConditionVariableCS RtlUnwind SystemTimeToTzSpecificLocalTime CreatePipe RemoveDirectoryW HeapQueryInformation GetProcAddress CreateMutexW GetSystemTimeAsFileTime QueryFullProcessImageNameW SystemTimeToFileTime GetWindowsDirectoryW FileTimeToLocalFileTime CloseHandle SetEvent Sleep CreateEventW OpenProcess WaitForMultipleObjects CompareFileTime GlobalUnlock GlobalLock GlobalFree GlobalAlloc FindClose FindNextFileW FindFirstFileW SetHandleInformation DeleteCriticalSection DecodePointer LoadLibraryW RaiseException GetLastError QueryActCtxW DeactivateActCtx InitializeCriticalSectionEx FindActCtxSectionStringW GetModuleFileNameW OutputDebugStringA GetModuleHandleExW SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA ReadConsoleW DuplicateHandle GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapSize HeapReAlloc GetTimeZoneInformation SetEnvironmentVariableW GetFileType EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect GetStdHandle ExitProcess IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry SetUnhandledExceptionFilter GetCPInfo LCMapStringEx CompareStringEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable SetLastError ActivateActCtx RtlPcToFileHeader GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle FindFirstFileExW GetCurrentDirectoryW InitOnceBeginInitialize InitOnceComplete GetLongPathNameW GetFullPathNameA GetOEMCP QueryPerformanceFrequency QueryPerformanceCounter FormatMessageA CreateDirectoryW SizeofResource HeapFree GetCurrentProcess ExpandEnvironmentStringsW GetTempPathW CreateFileW GetFileAttributesW GetCurrentThreadId SetFileAttributesW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapAlloc LocalFree VerSetConditionMask GetProcessHeap GetModuleHandleW FreeLibrary MulDiv IsWow64Process GetDriveTypeW LoadLibraryExW EnterCriticalSection LeaveCriticalSection GetFileAttributesExW FileTimeToSystemTime GetLocaleInfoEx GetUserDefaultUILanguage LCIDToLocaleName GetUserDefaultLCID MultiByteToWideChar CompareStringOrdinal WriteFile SetFilePointer WaitForSingleObject ReleaseMutex FormatMessageW GetLocalTime GetCurrentProcessId FlushFileBuffers WideCharToMultiByte GetStartupInfoW ReadFile TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW MoveFileExW GetExitCodeProcess FreeResource lstrcmpW GetThreadDescription GetModuleHandleA GetCurrentThread EnumResourceNamesW AddDllDirectory RemoveDllDirectory OutputDebugStringW CreateProcessW IsDebuggerPresent GetLogicalDrives ResetEvent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread CreateActCtxW

user32

SendMessageW MessageBeep CreatePopupMenu GetWindowPlacement ShowWindow IsWindow FillRect SetWindowLongPtrW SetTimer UnregisterClassW EnableWindow EndPaint BeginPaint ReleaseDC RegisterClipboardFormatA GetAsyncKeyState GetMonitorInfoW RegisterWindowMessageW GetDlgItem PrintWindow SetPropW EnumWindows GetTopWindow GetDlgCtrlID CreateIconIndirect MsgWaitForMultipleObjects SetWindowTextW RemovePropW GetIconInfo GetWindow CreateDialogIndirectParamW LoadMenuIndirectW EndDialog SetForegroundWindow UpdateLayeredWindow GetSysColor MapWindowPoints RedrawWindow IsWindowVisible OpenClipboard GetAncestor GetSysColorBrush SetRect DrawTextW DrawFocusRect EnumPropsExW CopyRect UnionRect InflateRect RealChildWindowFromPoint EndDeferWindowPos LockWindowUpdate DialogBoxIndirectParamW IsDialogMessageW BeginDeferWindowPos EnumChildWindows GetLastActivePopup DeferWindowPos FindWindowW BringWindowToTop IntersectRect ExitWindowsEx WaitForInputIdle EnumDisplayMonitors FindWindowExW GetMenu AdjustWindowRectEx GetClassInfoExW CharNextW CreateAcceleratorTableW GetDlgItemTextW SetDlgItemTextW DestroyAcceleratorTable FindWindowExA InvalidateRgn GetWindowLongPtrW ScreenToClient CallWindowProcW MessageBoxW PtInRect EnableMenuItem LoadIconW CopyImage GetSystemMenu SendInput SetActiveWindow ClientToScreen CloseClipboard SetMenuItemInfoW SystemParametersInfoW InvalidateRect ReleaseCapture GetDesktopWindow PostQuitMessage DestroyIcon DefWindowProcW CreateWindowExW WaitMessage RegisterClassExW DispatchMessageW PeekMessageW TranslateMessage ChangeWindowMessageFilterEx GetWindowThreadProcessId GetWindowTextLengthW GetMenuItemCount GetSystemMetrics GetShellWindow GetSubMenu RegisterWindowMessageA EmptyClipboard GetRawInputData GetDoubleClickTime AttachThreadInput RegisterRawInputDevices GetClassNameW DrawIconEx GetParent LoadImageW GetCursorPos GetWindowTextW GetWindowLongW GetMenuItemInfoW GetMessagePos PostMessageW GetWindowRect GetFocus DestroyWindow GetDC SetWindowPos EqualRect GetPropW MonitorFromWindow KillTimer GetClientRect RemoveMenu TrackPopupMenuEx SetWindowLongW FlashWindowEx IsChild SetWindowPlacement TrackMouseEvent GetForegroundWindow IsWindowEnabled SetRectEmpty SetCursor SetClipboardData SetCapture LoadCursorW GetUpdateRect SetFocus IsRectEmpty DestroyMenu FlashWindow MoveWindow OffsetRect

gdi32

CreateRectRgn GetCurrentObject RestoreDC SaveDC GetTextExtentPointW GetTextMetricsW TextOutW SetBkMode CreatePen CreateFontIndirectW GetObjectType RoundRect GetPixel SetTextColor SetBkColor CreateRectRgnIndirect DeleteObject GetObjectW DeleteDC SetLayout CreateCompatibleDC SelectObject CreateCompatibleBitmap CreateSolidBrush CreateDIBSection GetStockObject BitBlt GdiAlphaBlend GetDeviceCaps GetTextExtentPoint32W CreatePalette SetStretchBltMode CreateBitmap SetBrushOrgEx GetRgnBox CombineRgn

advapi32

CryptDestroyHash CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData ConvertSidToStringSidW OpenProcessToken RegQueryValueExW RegDeleteValueW RegCopyTreeW RegSetValueExW RegNotifyChangeKeyValue RegCloseKey RegOpenKeyExW RegDeleteTreeW RegEnumKeyExW RegCreateKeyExW DuplicateTokenEx GetLengthSid LookupPrivilegeValueW AdjustTokenPrivileges SetTokenInformation ConvertStringSidToSidW CreateProcessAsUserW GetTokenInformation

shell32

ord18 SHCreateItemFromIDList ShellExecuteExW SHGetKnownFolderPath SHChangeNotify SHGetIDListFromObject CommandLineToArgvW SetCurrentProcessExplicitAppUserModelID SHCreateItemFromParsingName ord645 ord4 ord2 ord644 ord190 Shell_NotifyIconW ShellExecuteW ord16 ord24

ole32

CoInitializeEx CLSIDFromProgID OleInitialize CoGetClassObject CoTaskMemAlloc OleUninitialize CLSIDFromString CoSetProxyBlanket OleLockRunning StringFromGUID2 GetHGlobalFromStream CoUninitialize CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal

oleaut32

LoadRegTypeLi LoadTypeLi OleCreateFontIndirect SysAllocString DispCallFunc SysStringLen SysAllocStringLen VariantInit VariantClear SysFreeString

shlwapi

ord12 PathFindFileNameW StrRetToBufW PathIsFileSpecW PathFindExtensionW StrRetToStrW PathAppendW ord487 SHDeleteEmptyKeyW ord219 PathFileExistsW PathIsURLW SHCreateStreamOnFileW ord16 SHDeleteKeyW AssocQueryStringW

uxtheme

GetThemePartSize IsAppThemed DrawThemeParentBackground OpenThemeData DrawThemeBackground GetThemeColor CloseThemeData SetWindowTheme GetThemeBackgroundContentRect GetThemeTextExtent DrawThemeText IsThemeActive

windowscodecs

WICConvertBitmapSource

d2d1

ord1 ord2

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

connect ioctlsocket getsockname getsockopt htonl listen ntohl ntohs recv select send setsockopt shutdown getaddrinfo freeaddrinfo getnameinfo accept WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents getpeername WSASetLastError WSAIoctl recvfrom sendto inet_pton socket htons __WSAFDIsSet closesocket bind gethostname WSAGetLastError WSACleanup gethostbyname WSAStartup WSACloseEvent inet_ntoa

iphlpapi

if_nametoindex

wintrust

WinVerifyTrust

urlmon

CoInternetGetSession

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

secur32

InitSecurityInterfaceW

bcrypt

BCryptGenRandom

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

655KB

Virtual Size

655KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_ed7b7f8d5f23ba14fbc8cc4599a3e5c3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

uxtheme

windowscodecs

d2d1

version

ws2_32

iphlpapi

wintrust

urlmon

crypt32

secur32

bcrypt

generic