2026-11-02_f485c4364256c48e8dff673e24c0a40a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom

General

Target
2026-11-02_f485c4364256c48e8dff673e24c0a40a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
Size 28.4MB
Sample261102-wsb3gsfg83
SHA256 65512759ad69762f6af6eed7707b84b4c3e01f37816a40d7c8565b5418109b53
MD5 f485c4364256c48e8dff673e24c0a40a
SHA1 6d8ae1eb5bafaec3afdbac5113025999be12727e
SHA512 0e4f0a28b76f97be23d604556c7cd131966b15e8f4144e2efd9c8606f757ac65808a156eb80a212518e2f056ebf0edc083fc0c7b75025cfbb9ae3c0f25a79b77
SSDEEP 786432:cpLMNk3hR4Z48G/PqDdy6arOTgUCunvol:Yl3hRx/Pq5y6arhuA
TLSH
T13D67335472915475E163343F320BEAD0E1D3786A4BF08AEBCB6C8D959F1B2F245E6B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_f485c4364256c48e8dff673e24c0a40a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom

File Explorer

2026-11-02_f485c4364256c48e8dff673e24c0a40a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom

.exe 28.4MB

2026-11-02_f485c4364256c48e8dff673e24c0a40a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom

IMPHASH 07ba9dfd0ae61fe425b41c4b3600ff6b
SHA256 65512759ad69762f6af6eed7707b84b4c3e01f37816a40d7c8565b5418109b53
MD5 f485c4364256c48e8dff673e24c0a40a
SHA1 6d8ae1eb5bafaec3afdbac5113025999be12727e
SHA512 0e4f0a28b76f97be23d604556c7cd131966b15e8f4144e2efd9c8606f757ac65808a156eb80a212518e2f056ebf0edc083fc0c7b75025cfbb9ae3c0f25a79b77
SSDEEP 786432:cpLMNk3hR4Z48G/PqDdy6arOTgUCunvol:Yl3hRx/Pq5y6arhuA
TLSH
T13D67335472915475E163343F320BEAD0E1D3786A4BF08AEBCB6C8D959F1B2F245E6B02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW CommandLineToArgvW

kernel32

DeleteCriticalSection WriteConsoleW CreateDirectoryW SetConsoleCtrlHandler GetCommandLineW GetFullPathNameW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW UnmapViewOfFile GetLastError CloseHandle GetProcAddress GetFileSize GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter SetDllDirectoryW GetExitCodeProcess GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapReAlloc RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc MultiByteToWideChar HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize

Name

.text

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28.3MB

Virtual Size

28.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_f485c4364256c48e8dff673e24c0a40a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom

shell32

kernel32

generic