General
- Target 2026-11-09_a8accbaa750534174ea1b32dd9cfc2a1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 13.5MB
- Sample261110-nysnesfa44
- SHA256 3ec6a483224d1dddd6f98d9749f2a50d91454dbeeb8b3df65fb769005d7f6161
- MD5 a8accbaa750534174ea1b32dd9cfc2a1
- SHA1 a109f162f139e718dd96f87e1be25e9b94693d25
- SHA512 ad369a1951a0ffafe294a3e9fe0105d0b9d1ab45582fbc30d28fe39bb99e58781b75e5c661abc1cea1d246098a02a39c88802870efb8f1d925176702bffe77bd
- SSDEEP 393216:izuBU7aW8bF4v4JuxNZBVSnGCnGjpi2bjRo4Ne8xeElwcAX:xYaW8pkRrBVSnGCnkpi2nRDeceElwcu
- TLSH T18AE633487BC204D5E99E4739C8E696B6E7B4BD320794CA8B1BF14C521D231E9FE39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-09_a8accbaa750534174ea1b32dd9cfc2a1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_a8accbaa750534174ea1b32dd9cfc2a1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-09_a8accbaa750534174ea1b32dd9cfc2a1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 13.5MB
- SHA256 3ec6a483224d1dddd6f98d9749f2a50d91454dbeeb8b3df65fb769005d7f6161
- MD5 a8accbaa750534174ea1b32dd9cfc2a1
- SHA1 a109f162f139e718dd96f87e1be25e9b94693d25
- SHA512 ad369a1951a0ffafe294a3e9fe0105d0b9d1ab45582fbc30d28fe39bb99e58781b75e5c661abc1cea1d246098a02a39c88802870efb8f1d925176702bffe77bd
- SSDEEP 393216:izuBU7aW8bF4v4JuxNZBVSnGCnGjpi2bjRo4Ne8xeElwcAX:xYaW8pkRrBVSnGCnkpi2nRDeceElwcu
- TLSH T18AE633487BC204D5E99E4739C8E696B6E7B4BD320794CA8B1BF14C521D231E9FE39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10Renames multiple (64) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Disables Task Manager via registry modification
Loads dropped DLL