2026-11-01_ed2ee8e028508f0d2c222eabb8ee202a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_ed2ee8e028508f0d2c222eabb8ee202a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom_stealc
Size 1.4MB
Sample261102-ep5ryssv6k
SHA256 d06431e7dd95f8463151301b37571453f633a081f08fb25714fd2f2c02bb798e
MD5 ed2ee8e028508f0d2c222eabb8ee202a
SHA1 e92fc1680a2ca97b706af38d3bd2881a5e9a83aa
SHA512 ac5d831018acae3abdb64c4b10e5ef7a863c11518048a5eb04402d412a2a8cffd0efce40107a37a86e047273f9c5e7c494b76452303a5fe01ffe95e256271383
SSDEEP 24576:Hf/86/7CI10/6e3cxUX5Ei/n8y1zl4pFEWFO/0vgaGFpqaJU+9i48V7hWupm3i:Hf/vOI2MmX5Ei/n8ytl4pFEWF7v4pqaG
TLSH
T1DE657E57B2E800E8E1B7C274C9675907EBB278565334DADF038049A92F27BE09E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_ed2ee8e028508f0d2c222eabb8ee202a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_ed2ee8e028508f0d2c222eabb8ee202a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

.exe 1.4MB

2026-11-01_ed2ee8e028508f0d2c222eabb8ee202a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

IMPHASH 51d28abfcfbaf1e8cd9a8a67350a9809
SHA256 d06431e7dd95f8463151301b37571453f633a081f08fb25714fd2f2c02bb798e
MD5 ed2ee8e028508f0d2c222eabb8ee202a
SHA1 e92fc1680a2ca97b706af38d3bd2881a5e9a83aa
SHA512 ac5d831018acae3abdb64c4b10e5ef7a863c11518048a5eb04402d412a2a8cffd0efce40107a37a86e047273f9c5e7c494b76452303a5fe01ffe95e256271383
SSDEEP 24576:Hf/86/7CI10/6e3cxUX5Ei/n8y1zl4pFEWFO/0vgaGFpqaJU+9i48V7hWupm3i:Hf/vOI2MmX5Ei/n8ytl4pFEWF7v4pqaG
TLSH
T1DE657E57B2E800E8E1B7C274C9675907EBB278565334DADF038049A92F27BE09E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

846928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\s4archive\trunk\program\work_EU\builds\ReleaseInt_Vivy_v145_64\S4_Bridge\S4_Bridge.pdb

kernel32

CloseHandle SetEvent ResetEvent WaitForSingleObject CreateThread MultiByteToWideChar GetModuleHandleW GetProcAddress CreateDirectoryW OutputDebugStringW GetCurrentProcessId GetSystemInfo FindResourceExW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LoadLibraryA GetLocaleInfoA Sleep HeapCreate HeapValidate CreateEventW WaitForMultipleObjects GetDiskFreeSpaceW GetSystemTime CreateFileW SetUnhandledExceptionFilter SetErrorMode QueryPerformanceCounter QueryPerformanceFrequency GetFileSize SetFilePointer WriteFile SetLastError PostQueuedCompletionStatus GetCurrentThread SetThreadPriorityBoost TlsAlloc TerminateProcess TlsSetValue RaiseException ReleaseSemaphore CreateSemaphoreW OutputDebugStringA SetThreadPriority InitializeCriticalSectionEx FindClose CreateFileA ReadFile CreateDirectoryA GetLocalTime SetConsoleOutputCP GetModuleFileNameA GetModuleHandleA GetCurrentDirectoryA SetCurrentDirectoryA GetPrivateProfileStringA FormatMessageW LocalFree CreateEventA WaitForSingleObjectEx GetStdHandle GetConsoleScreenBufferInfo AllocConsole FreeConsole SetConsoleTextAttribute WriteConsoleW FlushFileBuffers HeapQueryInformation SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW GetCurrentProcess GetCurrentThreadId TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DebugBreak GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetLastError WideCharToMultiByte TlsGetValue GetTickCount FindFirstFileExW GetOEMCP RtlUnwind GetACP IsValidCodePage GetFileSizeEx SetEndOfFile SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA ExitProcess GetModuleHandleExW FreeLibrary SetFilePointerEx GetFileType UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW LCMapStringEx EncodePointer IsDebuggerPresent

user32

MessageBoxW MessageBoxA

advapi32

SetServiceStatus RegisterServiceCtrlHandlerA QueryServiceStatus DeleteService OpenServiceA CloseServiceHandle CreateServiceA OpenSCManagerA StartServiceCtrlDispatcherA CryptGenRandom CryptReleaseContext CryptAcquireContextW

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString

shlwapi

PathStripPathA PathRemoveExtensionA PathRemoveFileSpecA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

winmm

timeKillEvent timeSetEvent timeGetTime

ws2_32

htons WSAGetLastError inet_ntoa ntohs getsockopt gethostbyname WSAStartup WSACleanup socket WSASetLastError __WSAFDIsSet gethostname closesocket connect ioctlsocket getpeername getsockname listen select WSAGetOverlappedResult WSAIoctl WSASocketW WSASendTo WSASend setsockopt bind WSARecv WSARecvFrom inet_addr

dbghelp

MiniDumpWriteDump

mswsock

GetAcceptExSockaddrs

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

334KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_ed2ee8e028508f0d2c222eabb8ee202a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

rpcrt4

winmm

ws2_32

dbghelp

mswsock

generic