2026-09-27_1fa76e84d5ed244f7ad16adf8df700e3_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_pos_satacom_vidar
Multi-malware dropper with C2 and keylogging
Detects executables Discord URL observed in first stage droppersTrusted vendor metadata but high-entropy code/data (potential spoofing)
SHA-25643f590ae32125b69adbc0b4b1ac13341d88d72cafac036b90b5e17b23e86c184
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400488d0519d58f01c3ccccccccccccccccH...............
0x4104c894424184c894c2420535556574883L.D$.L.L$ SUVWH.
0x420ec38498bf0488d6c2478488bda488bf9.8I..H.l$xH..H..
0x430e8cbffffff48896c24284c8bce4c8bc3.....H.l$(L..L..
0x44048c744242000000000488bd7488b08e8H.D$ ....H..H...
0x45068be000085c0b9ffffffff0f48c14883h...........H.H.
0x460c4385f5e5d5bc3cccccccccccccccccc.8_^][..........
0x47048895424104c894424184c894c242053H.T$.L.D$.L.L$ S
0x48056574883ec30488bfa488d742460488bVWH..0H..H.t$`H.
0x490d9e86affffff4533c948897424204c8b..j...E3.H.t$ L.
0x4a0c7488bd3488b08e898ba00004883c430.H..H.......H..0
0x4b05f5e5bc3cccccccccccccccccccccccc_^[.............
0x4c04c894424184c894c2420535556574883L.D$.L.L$ SUVWH.
0x4d0ec38498bf0488d6c2478488bda488bf9.8I..H.l$xH..H..
0x4e0e81bffffff48896c24284c8bce4c8bc3.....H.l$(L..L..
0x4f048c744242000000000488bd7488b0848H.D$ ....H..H..H
0x50083c902e860bb000085c0b9ffffffff0f....`...........
0x51048c14883c4385f5e5d5bc3ccccccccccH.H..8_^][......
0x520b838000100e836880100482be0488b05.8....6...H+.H..
0x530cc2e8d014833c4488984242000010033....H3.H..$ ...3
0x540c0488d54242041b80000010066894424.H.T$ A.....f.D$
0x55020ff15199f0100ffc83dffff00007722 ........=....w"
0x560488d4c2420e836d10000488b8c242000H.L$ .6...H..$ .
0x57001004833cce8b62400004881c4380001..H3...$..H..8..
0x58000c333c0488b8c24200001004833cce8..3.H..$ ...H3..
0x5909c2400004881c438000100c3cccccccc.$..H..8........
0x5a048895c241048896c2418488974242057H.\$.H.l$.H.t$ W
0x5b04881ec90000000488b05422e8d014833H......H..B...H3
0x5c0c448898424800000000fb601488d5c24.H..$.......H.\$
0x5d03033ed488bf166896c2430bf2800000003.H..f.l$0.(...
0x5e084c0746b0f1f40000f1f840000000000..tk..@.........
0x5f041b80200000088442420488d54242040A......D$ H.T$ @
0x600886c2421488d4c2424e82e5f00004883.l$!H.L$$.._..H.
0x610f801756e488bcf488bc366392b740d90..unH..H..f9+t..
0x6204883c00248ffc966392875f44883f901H...H..f9(u.H...
0x63072500fb74c242448ffc66689084883c3rP..L$$H..f..H..
0x640026689680248ffcf0fb60684c075a148.f.h.H.......u.H
0x6508d4c2430e8c7feffff488b8c24800000.L$0.....H..$...
0x660004833cce8c72300004c8d9c24900000.H3...#..L..$...
0x67000498b5b18498b6b20498b7328498be3.I.[.I.k I.s(I..
0x229e040000ff15f9810100488bd84885c00f.........H..H...
0x22ae848300000041b9000800004c8d857001.....A.....L..p.
0x22be000033d2488bc8ff159d81010085c075..3.H..........u
0x22ce05458be6eb2d41b101488d9570010000.E...-A..H..p...
0x22de41b800080000488d8d70010000e8d0e7A.....H..p......
0x22eeffffba00080000488d8d70010000e81f.......H..p.....
0x22fee6ffffb101e878e9ffff488d8d700100......x...H..p..
0x230e00482bc1440fb7010fb71401442bc275.H+.D.......D+.u
0x231e084883c10285d275eb4585c0498bc649.H.....u.E..I..I
0x232e0f44c44c8be0eb034d8be6488bcbff15.D.L....M..H....
0x233e768101004d85e40f85ea000000eb034dv...M..........M
0x234e8be6488d0dd9b08c01e824e4ffff488d..H.......$...H.
0x235e0d8db08c01e818e4ffff488d0d51b08c..........H..Q..
0x236e01 .
0x1a1a04055488bea48894d10488b018b08894d@UH..H.M.H.....M
0x1a1b00881f9050000c0740c81f91d0000c074.......t.......t
0x1a1c00433c0eb05b8010000005dc3cccccccc.3........].....
0x1a1d040554883ec20488bea488b0133c98138@UH.. H..H..3..8
0x1a1e0050000c00f94c18bc14883c4205dc3cc.........H.. ]..
0x1a1f000000000000000000000000000000000................
0x1a20050328d010000000042328d0100000000P2......B2......
0x1a210922b8d0100000000a62b8d0100000000.+.......+......
0x1a220be2b8d0100000000d02b8d0100000000.+.......+......
0x1a230e22b8d0100000000f62b8d0100000000.+.......+......
0x1a240062c8d0100000000122c8d0100000000.,.......,......
0x1a250262c8d01000000003a2c8d0100000000&,......:,......
0x1a260502c8d01000000006a2c8d0100000000P,......j,......
0x1a270842c8d01000000009e2c8d0100000000.,.......,......
0x1a280ae2c8d0100000000c42c8d0100000000.,.......,......
0x1a290d22c8d0100000000e82c8d0100000000.,.......,......
0x1a2a0fc2c8d01000000000a2d8d0100000000.,.......-......
0x1a2b0122d8d0100000000222d8d0100000000.-......"-......
0x1a2c0302d8d0100000000422d8d01000000000-......B-......
0x1a2d0582d8d01000000006a2d8d0100000000X-......j-......
0x1a2e0802d8d01000000009a2d8d0100000000.-.......-......
0x1a2f0ac2d8d0100000000c62d8d0100000000.-.......-......
0x1a300da2d8d0100000000ec2d8d0100000000.-.......-......
0x1a310022e8d0100000000162e8d0100000000................
0x1a320302e8d0100000000442e8d01000000000.......D.......
0x1a330602e8d01000000007e2e8d0100000000`.......~.......
0x1a340922e8d0100000000ae2e8d0100000000................
0x1a350c42e8d0100000000da2e8d0100000000................
0x1a360ee2e8d0100000000002f8d0100000000........./......
0x1a37036328d0100000000222f8d010000000062......"/......
0x1a380302f8d0100000000402f8d01000000000/......@/......
0x1a390582f8d0100000000702f8d0100000000X/......p/......
0x1a3a0882f8d0100000000b02f8d0100000000./......./......
0x1a3b0bc2f8d0100000000ca2f8d0100000000./......./......
0x1a3c0d82f8d0100000000e22f8d0100000000./......./......
0x1a3d0f02f8d010000000000308d0100000000./.......0......
0x1a3e012308d010000000026308d0100000000.0......&0......
0x1a3f034308d01000000004a308d010000000040......J0......
0x1a4005c308d010000000072308d0100000000\0......r0......
0x1a4107e308d01000000008a308d0100000000~0.......0......
0x1a42096308d0100000000a4308d0100000000.0.......0......
0x1a430b2308d0100000000bc308d0100000000.0.......0......
0x1a440da308d0100000000ec308d0100000000.0.......0......
0x1a450fc308d01000000000a318d0100000000.0.......1......
0x1a4601c318d010000000028318d0100000000.1......(1......
0x1a4703c318d01000000004c318d0100000000<1......L1......
0x9c89e300000000000000000000000000000000................
0x9c89f300000000000000000000000000000000................
0x9c8a0300000000000000000000000000000000................
0x9c8a1300000000703700000002020030823760....p7......0.7`
0x9c8a2306092a864886f70d010702a082375130..*.H........7Q0
0x9c8a3382374d020101310f300d060960864801.7M...1.0...`.H.
0x9c8a4365030402010500305c060a2b06010401e......0\..+....
0x9c8a538237020104a04e304c3017060a2b0601.7....N0L0...+..
0x9c8a630401823702010f3009030100a004a202...7...0........
0x9c8a7380003031300d06096086480165030402..010...`.H.e...
0x9c8a830105000420b742251d99e3d6263eff66.... .B%....&>.f
0x9c8a938a761704f35acc44308482fef7a703f5.v...Z.D0.......
0x9c8aa3a1375cdb14a0821bd2308205cc308203.7\......0...0..
0x9c8ab3b4a00302010202105498d2d1d45b1995........T....[..
0x9c8ac3481379c811c08799300d06092a864886H.y.....0...*.H.
0x9c8ad3f70d01010c05003077310b3009060355.......0w1.0...U
0x9c8ae3040613025553311e301c060355040a13....US1.0...U...
0x9c8af3154d6963726f736f667420436f72706f.Microsoft Corpo
0x9c8b03726174696f6e31483046060355040313ration1H0F..U...
0x9c8b133f4d6963726f736f6674204964656e74?Microsoft Ident
0x9c8b2369747920566572696669636174696f6eity Verification
0x9c8b3320526f6f742043657274696669636174 Root Certificat
0x9c8b436520417574686f726974792032303230e Authority 2020
0x9c8b53301e170d3230303431363138333631360...200416183616
0x9c8b635a170d3435303431363138343434305aZ..450416184440Z
0x9c8b733077310b3009060355040613025553310w1.0...U....US1
0x9c8b831e301c060355040a13154d6963726f73.0...U....Micros
0x9c8b936f667420436f72706f726174696f6e31oft Corporation1
0x9c8ba34830460603550403133f4d6963726f73H0F..U...?Micros
0x9c8bb36f6674204964656e7469747920566572oft Identity Ver
0x9c8bc3696669636174 ificat
⋯7 more rows
0x18d580a434f4e46494723230a7b2277223a2022CONFIG##.{"w": "
0x18d581a68747470733a2f2f646973636f72642ehttps://discord.
0x18d582a636f6d2f6170692f776562686f6f6b73com/api/webhooks
0x18d583a2f313535333730373233383332383131/155370723832811
0x18d584a313136342f4b517158536a52347163761164/KQqXSjR4qcv
⋯6 more rows