2026-05-16_d4af4642c553b5e482e9085b418bbb17_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-16_d4af4642c553b5e482e9085b418bbb17_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 4.3MB
Sample260516-df7draav7x
SHA256 3eb155b0d7f780a6dac9f0e282d00ade4e95ef257ca02851ea1a66d8ca305f3e
MD5 d4af4642c553b5e482e9085b418bbb17
SHA1 234de9c4593f1dd9ea663e0e37d97119e2ff7df2
SHA512 7212b9a263ac9a7d67a75db523edf529428c959ca31bebf4c3739eee1b8c1b9161291ebe5f5495879752460e19a0fd0348e43b204d91c5040538b6a8eddf0a48
SSDEEP 98304:lm6UnmbNTqr9PHABDSGqWy4oOVP2s2uBXRxkOFKdfv:l4WNWr9PSpqvWPBz9kLdX
TLSH
T16B26121DD6D702E8DCA7C5FDCA934113D7B2B8460334DAEB02D19B560FE7AE09A3A611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-16_d4af4642c553b5e482e9085b418bbb17_blankgrabber_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-16_d4af4642c553b5e482e9085b418bbb17_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 4.3MB

2026-05-16_d4af4642c553b5e482e9085b418bbb17_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH 6baf91e587892c296d304b3daf25a3cd
SHA256 3eb155b0d7f780a6dac9f0e282d00ade4e95ef257ca02851ea1a66d8ca305f3e
MD5 d4af4642c553b5e482e9085b418bbb17
SHA1 234de9c4593f1dd9ea663e0e37d97119e2ff7df2
SHA512 7212b9a263ac9a7d67a75db523edf529428c959ca31bebf4c3739eee1b8c1b9161291ebe5f5495879752460e19a0fd0348e43b204d91c5040538b6a8eddf0a48
SSDEEP 98304:lm6UnmbNTqr9PHABDSGqWy4oOVP2s2uBXRxkOFKdfv:l4WNWr9PSpqvWPBz9kLdX
TLSH
T16B26121DD6D702E8DCA7C5FDCA934113D7B2B8460334DAEB02D19B560FE7AE09A3A611
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

514064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2044c_D20260430T173049\fa_rss\x64\Release\Setup.pdb

advapi32

QueryServiceObjectSecurity ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW RegOpenKeyExW StartServiceW RegSetValueExW ControlService SetServiceObjectSecurity DeleteService RegCreateKeyExW ConvertSecurityDescriptorToStringSecurityDescriptorW ChangeServiceConfig2W OpenSCManagerW CloseServiceHandle RegCloseKey CreateServiceW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW RegEnumKeyExW RegDeleteValueW RegDeleteTreeW RegDeleteKeyExW MapGenericMask DuplicateToken CheckTokenMembership FreeSid OpenProcessToken GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW AllocateAndInitializeSid AccessCheck GetSecurityInfo

winhttp

WinHttpQueryHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpReadData WinHttpSendRequest

wininet

InternetConnectW InternetReadFile HttpSendRequestW InternetOpenW InternetOpenUrlW HttpOpenRequestW InternetCloseHandle

comctl32

InitCommonControlsEx ord412 ord410 ord413 PropertySheetW

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoTaskMemFree CoInitializeSecurity CoInitialize

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW

kernel32

GetTimeZoneInformation HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW RaiseException InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetModuleFileNameW GetTempPathW CloseHandle LocalFree CreateProcessW ExpandEnvironmentStringsA GetUserDefaultUILanguage LCIDToLocaleName OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId WideCharToMultiByte QueryFullProcessImageNameW GetCurrentThreadId GetCommandLineW CreateMutexW OpenEventW Sleep GetLastError SetEvent GetTempFileNameW MoveFileW SizeofResource LockResource LoadResource FindResourceW ReadFile FindFirstFileExW FindNextFileW GetCurrentProcess WriteFile TerminateProcess RemoveDirectoryW CreateNamedPipeW FindClose WaitForSingleObject GetFileAttributesW DisconnectNamedPipe MultiByteToWideChar DeleteFileW ExitProcess WaitNamedPipeW ConnectNamedPipe FlushFileBuffers GetSystemFirmwareTable GetModuleHandleW MulDiv MoveFileExW GetFileAttributesExW SetFileAttributesW GetFileType GetTickCount GetFileSizeEx GetFileTime SetFilePointerEx SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCPInfo CompareStringEx QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx TlsSetValue LeaveCriticalSection EnterCriticalSection TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx GetStringTypeW GetLocaleInfoEx FormatMessageA CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetProcAddress DeviceIoControl AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileW CreateDirectoryW TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetConsoleOutputCP CompareStringW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree TlsGetValue CreateFileW VirtualProtect

user32

EnableWindow GetWindowLongW GetKeyState GetWindowRect InflateRect MonitorFromWindow FillRect GetSystemMetrics SetWindowTextW GetCapture DestroyIcon GetDlgCtrlID MapWindowPoints TrackMouseEvent IsWindowEnabled SetWindowLongW GetDlgItem DrawIconEx PtInRect LoadImageW InvalidateRect BeginPaint EndPaint DestroyWindow GetDC SetWindowPos SetWindowLongPtrW CreateWindowExW SendMessageW UpdateWindow SetCursor GetClientRect DrawTextW GetSysColorBrush GetParent ReleaseDC GetWindowTextW MessageBoxW ShowWindow SetFocus SetForegroundWindow GetMessageW ScreenToClient CallNextHookEx WindowFromPoint IsWindow DispatchMessageW IsChild GetForegroundWindow UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostThreadMessageW GetCursorPos MonitorFromPoint GetMonitorInfoW EnumDisplaySettingsW GetSystemMenu GetWindowDC FrameRect SetDlgItemTextW RedrawWindow OffsetRect EnableMenuItem KillTimer IsWindowVisible LoadCursorW SetTimer PostMessageW GetWindowLongPtrW

gdi32

DeleteDC CreatePen SetBkColor CreateSolidBrush RoundRect CreateCompatibleDC GetDeviceCaps SetTextColor SetBkMode DeleteObject CreateFontIndirectW BitBlt GetStockObject CreateCompatibleBitmap SelectObject

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

shlwapi

PathFindFileNameW

iphlpapi

GetAdaptersInfo

uxtheme

SetWindowTheme

bcrypt

BCryptFinishHash BCryptCreateHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptHashData BCryptGenerateSymmetricKey BCryptEncrypt BCryptDestroyHash BCryptDestroyKey

ntdll

RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlUnwind

Name

.text

Size

733KB

Virtual Size

732KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-16_d4af4642c553b5e482e9085b418bbb17_blankgrabber_icedid_luca-stealer_njrat_stealc

advapi32

winhttp

wininet

comctl32

ole32

shell32

kernel32

user32

gdi32

oleaut32

shlwapi

iphlpapi

uxtheme

bcrypt

ntdll

generic