2026-11-11_1c23caa73c6fc795cb18fbac57ba37aa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_1c23caa73c6fc795cb18fbac57ba37aa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 6.8MB
Sample261113-twprmsdx4q
SHA256 af1e660e97c8f821c78544c361881b82344e5fc5b4eddccaea56fa8460903c1b
MD5 1c23caa73c6fc795cb18fbac57ba37aa
SHA1 6d3dcae8a6cde1a113bc056a526b0bcd42f93f7d
SHA512 13aad58b33a7b33646023d6a31482dfdbb61b8c40ef3cb2b6fde004b7e77c21e97bfde3b91d9541f533367bb2955cce7993701f90df232fae8d66699b4be3640
SSDEEP 49152:DLKZr4+CmzQ9MyqO0C59MebQSi+4bp99ckwnsLe0i/ub8rYxKFdu9CwJsv6t4RE3:49dy5OQYxKFdu9CwJsv6tDJMA
TLSH
T1CF761A026AFA4141F6F79B34D9F652628B727C86AB34969F024831295D337F09E32737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_1c23caa73c6fc795cb18fbac57ba37aa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-11-11_1c23caa73c6fc795cb18fbac57ba37aa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 6.8MB

2026-11-11_1c23caa73c6fc795cb18fbac57ba37aa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 5c82c9db66549f13a797ae61408260cf
SHA256 af1e660e97c8f821c78544c361881b82344e5fc5b4eddccaea56fa8460903c1b
MD5 1c23caa73c6fc795cb18fbac57ba37aa
SHA1 6d3dcae8a6cde1a113bc056a526b0bcd42f93f7d
SHA512 13aad58b33a7b33646023d6a31482dfdbb61b8c40ef3cb2b6fde004b7e77c21e97bfde3b91d9541f533367bb2955cce7993701f90df232fae8d66699b4be3640
SSDEEP 49152:DLKZr4+CmzQ9MyqO0C59MebQSi+4bp99ckwnsLe0i/ub8rYxKFdu9CwJsv6t4RE3:49dy5OQYxKFdu9CwJsv6tDJMA
TLSH
T1CF761A026AFA4141F6F79B34D9F652628B727C86AB34969F024831295D337F09E32737
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1632400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Programming\MyProjects\Vaultik\build\release\vcpkg_installed\vcpkg\blds\qtbase\x64-windows-static-rel\bin\qtpaths.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

userenv

GetUserProfileDirectoryW

advapi32

SetSecurityDescriptorOwner RegNotifyChangeKeyValue RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation SystemFunction036 OpenProcessToken AddAccessAllowedAceEx AddAccessDeniedAceEx AllocateAndInitializeSid CopySid DuplicateToken FreeSid GetLengthSid InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup RegFlushKey LookupAccountSidW GetNamedSecurityInfoW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW

authz

AuthzFreeResourceManager AuthzInitializeContextFromToken AuthzInitializeContextFromSid AuthzFreeContext AuthzInitializeResourceManager AuthzAccessCheck

kernel32

ReleaseMutex CreateMutexA VirtualAlloc VirtualFree RtlUnwind OutputDebugStringW GetCurrentThread GetModuleHandleW GetProcAddress LocalFree GetConsoleWindow GetCommandLineW GetCurrentProcessId GetStartupInfoW GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetSystemTime GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW GetLogicalDrives GetLongPathNameW RemoveDirectoryW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW CloseHandle SetErrorMode DeviceIoControl CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx FormatMessageW FlushFileBuffers GetFileType ReadFile SetEndOfFile SetFileInformationByHandle SetFilePointerEx WriteFile GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile LCMapStringEx GetStdHandle GetModuleFileNameW AllocConsole FreeConsole AttachConsole WaitForSingleObject Sleep GetCurrentThreadId SetThreadPriority GetThreadPriority TerminateThread ResumeThread SetThreadInformation SetThreadDescription GetProcessGroupAffinity GetActiveProcessorCount GetDateFormatW GetTimeFormatW LCMapStringW GetLocaleInfoW LocaleNameToLCID GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages GetTimeZoneInformation GetGeoInfoW GetUserGeoID SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetEnvironmentStringsW FreeEnvironmentStringsW SetLastError GetExitCodeProcess OpenProcess K32GetModuleFileNameExW FindFirstFileExW FindNextFileW QueryPerformanceCounter CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait FreeLibrary GetModuleHandleExW QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive WriteConsoleW HeapQueryInformation HeapSize GetProcessHeap GetOEMCP IsValidCodePage SetEnvironmentVariableW GetFileSizeEx HeapReAlloc EnumSystemLocalesW IsValidLocale CompareStringW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetConsoleOutputCP ReadConsoleW GetConsoleMode UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext FreeLibraryAndExitThread ExitThread CreateThread SetStdHandle SetFileAttributesW GetCommandLineA ExitProcess FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetCPInfo GetStringTypeW DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable

netapi32

NetShareEnum NetApiBufferFree

ntdll

NtQueryKey

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree

shell32

CommandLineToArgvW SHGetKnownFolderPath

user32

GetQueueStatus DestroyWindow CreateWindowExW MsgWaitForMultipleObjectsEx SetTimer MessageBoxW CharPrevExA PostMessageW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW RegisterClassW UnregisterClassW SetCoalescableTimer KillTimer GetWindowLongPtrW SetWindowLongPtrW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeKillEvent timeSetEvent

ws2_32

WSAAsyncSelect

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_1c23caa73c6fc795cb18fbac57ba37aa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

ntdll

ole32

shell32

user32

version

winmm

ws2_32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic