2026-10-02_98f334d0b560e22ba07b6106429c6f18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Cobalt Strike, credential theft, evasion
Process hunter kills processes by nameAssembly LOOP target mnemonic
SHA-2563084596c9970625378f6d9a88b51ec459563d8e687752a4edfcd22ceedef6585
Evidence
⋯3 more rows
0x3d64d033c04c8b6c24484883c468415f5fc3b83.L.l$HH..hA__..
0x3d64e04d5a000048899c24900000008bdf6641MZ..H..$......fA
0x3d64f039060f853f0100004963463c85c00f8e9...?...IcF<....
0x3d65003301000041813c065045000048896c243...A.<.PE..H.l$
0x3d651060498d2c060f85170100000fb74518b9`I.,.........E..
⋯7 more rows
⋯3 more rows
0xbed9b02000460069006c00650073005c000000 .F.i.l.e.s.\...
0xbed9c043003a005c0052006f006c0061006e00C.:.\.R.o.l.a.n.
0xbed9d064002000560053005c00360034005c00d. .V.S.\.6.4.\.
0xbed9e053004f0055004e004400200043006100S.O.U.N.D. .C.a.
0xbed9f06e007600610073002000560041002e00n.v.a.s. .V.A...
0xbeda0064006c006c0000000000000000000000d.l.l...........
0xbeda1043003a005c00500072006f0067007200C.:.\.P.r.o.g.r.
0xbeda2061006d002000460069006c0065007300a.m. .F.i.l.e.s.
0xbeda305c0043006f006d006d006f006e002000\.C.o.m.m.o.n. .
0xbeda40460069006c00650073005c0056005300F.i.l.e.s.\.V.S.
0xbeda50540033005c0053004f0055004e004400T.3.\.S.O.U.N.D.
0xbeda602000430061006e007600610073002000 .C.a.n.v.a.s. .
0xbeda70560041002e0064006c006c0000000000V.A...d.l.l.....
0xbeda8043003a005c0052006f006c0061006e00C.:.\.R.o.l.a.n.
0xbeda9064002000560053005c0053004f005500d. .V.S.\.S.O.U.
0xbedaa04e0044002000430061006e0076006100N.D. .C.a.n.v.a.
⋯7 more rows
⋯3 more rows
0xbeeb5700610062007200690075002000610067.a.b.r.i.u. .a.g
0xbeeb67006f00720061003b0020006600690063.o.r.a.;. .f.i.c
0xbeeb77006100200063006f006d006f00200074.a. .c.o.m.o. .t
0xbeeb870069006d006200720065000000000000.i.m.b.r.e......
0xbeeb970000000000000000004a00650074007a.........J.e.t.z
0xbeeba700740020006e00690063006800740020.t. .n.i.c.h.t.
0xbeebb700f6006600660065006e006200610072...f.f.e.n.b.a.r
⋯7 more rows
⋯3 more rows
0xbeef482000730061006c007400610072000000 .s.a.l.t.a.r...
0xbeef584e006900630068007400200061006200N.i.c.h.t. .a.b.
0xbeef686c00650067006200610072002c002000l.e.g.b.a.r.,. .
⋯7 more rows
⋯7 more rows
0x12fe6d6010043616e63656c496f457800005500..CancelIoEx..U.
0x12fe6e65465726d696e61746550726f63657373TerminateProcess
0x12fe6f6000033004f70656e50726f6365737300..3.OpenProcess.
0x12fe70606004765744c6f63616c54696d650000..GetLocalTime..
0x12fe7160000437265617465546f6f6c68656c70..CreateToolhelp
0x12fe7263332536e617073686f7400000700507232Snapshot....Pr
0x12fe7366f636573733332466972737457000800ocess32FirstW...
0x12fe74650726f6365737333324e657874570000Process32NextW..
0x12fe7560200436f6d7061726546696c6554696d..CompareFileTim
0x12fe76665000800476574557365724465666175e...GetUserDefau
0x12fe7766c7455494c616e677561676500000700ltUILanguage....
0x12fe7864f75747075744465627567537472696eOutputDebugStrin
0x12fe796675700002300476c6f62616c4d656d6fgW..#.GlobalMemo
0x12fe7a672795374617475734578000013004765ryStatusEx....Ge
0x12fe7b67453797374656d496e666f0012004765tSystemInfo...Ge
0x12fe7c67453797374656d4669726d7761726554tSystemFirmwareT
0x12fe7d661626c6500000c004765745068797369able....GetPhysi
0x12fe7e663616c6c79496e7374616c6c65645379callyInstalledSy
⋯4 more rows
0x12fe836696d65546f46696c6554696d65006100imeToFileTime.a.
0x12fe84653657446696c6554696d65001400446fSetFileTime...Do
0x12fe856734461746554696d65546f46696c6554sDateTimeToFileT
0x12fe866696d65000a0053797374656d54696d65ime...SystemTime
0x12fe876546f46696c6554696d65000032004973ToFileTime..2.Is
0x12fe88650726f636573736f7246656174757265ProcessorFeature
0x12fe89650726573656e74002000476574566572Present. .GetVer
0x12fe8a673696f6e4578570015004765744c6f63sionExW...GetLoc
0x12fe8b6616c65496e666f570000030052656743aleInfoW....RegC
⋯8 more rows