2026-08-01_71ea96cd8af69933e6b840f7f90299aa_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_71ea96cd8af69933e6b840f7f90299aa_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 1.9MB
Sample260801-dmstyavwct
SHA256 3df9cb2a1bb978bce0ccdcf0466300d714ce4f15b32c3306ddc0413a3091e9fd
MD5 71ea96cd8af69933e6b840f7f90299aa
SHA1 4cccac68c793572058e4ca86410fc097cd5a3063
SHA512 08958445cd7ca2c1c5fe63749a5d94b1d677d3b26715069969147c215a59821319a6a84758d3bb431dc94207ffd8328f2845f6fe9aaf1da1a44cb994d8bb3c88
SSDEEP 49152:I8OZB8ulm4BuAAXB9aa9THOpAsHurI8joghvk7:Ij/Bu8pAsHD
TLSH
T18F959F5BA2A801F8D0EBD179CE46890BEBB1744A1771D7DF07E0469A1F237A15E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-01_71ea96cd8af69933e6b840f7f90299aa_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 1.9MB

2026-08-01_71ea96cd8af69933e6b840f7f90299aa_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH ded2cd3499855b9c105ca5b0d800e532
SHA256 3df9cb2a1bb978bce0ccdcf0466300d714ce4f15b32c3306ddc0413a3091e9fd
MD5 71ea96cd8af69933e6b840f7f90299aa
SHA1 4cccac68c793572058e4ca86410fc097cd5a3063
SHA512 08958445cd7ca2c1c5fe63749a5d94b1d677d3b26715069969147c215a59821319a6a84758d3bb431dc94207ffd8328f2845f6fe9aaf1da1a44cb994d8bb3c88
SSDEEP 49152:I8OZB8ulm4BuAAXB9aa9THOpAsHurI8joghvk7:Ij/Bu8pAsHD
TLSH
T18F959F5BA2A801F8D0EBD179CE46890BEBB1744A1771D7DF07E0469A1F237A15E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

8d:c3:95:5a:ac:e1:9d:e5:56:b5:af:2e:54:2d:49:89:42:7a:1c:43:56:7e:2a:1f:3e:de:37:56:d2:35:a9:df

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 26, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

224996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\_work\1\s\bin\x64\Release\UpdateAgent.pdb

api-ms-win-core-localization-l1-2-0

LCMapStringW GetACP EnumSystemLocalesW GetOEMCP GetLocaleInfoW IsValidLocale FormatMessageW IsValidCodePage GetUserDefaultLCID

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId ExitThread TlsFree TlsSetValue ExitProcess TlsGetValue TlsAlloc CreateThread

api-ms-win-core-heap-l1-1-0

HeapSize HeapCompact HeapFree HeapValidate HeapCreate HeapReAlloc HeapAlloc GetProcessHeap HeapDestroy

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetModuleHandleW GetModuleFileNameW GetModuleHandleExW GetModuleFileNameA GetProcAddress FreeLibrary FreeLibraryAndExitThread LoadStringW

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringA OutputDebugStringW IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte CompareStringW MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection TryEnterCriticalSection ReleaseMutex InitializeCriticalSection EnterCriticalSection WaitForSingleObjectEx CreateMutexW

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler CoGetObjectContext CoCreateInstance CoGetApartmentType CoCreateGuid

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoActivateInstance RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsDeleteString

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegGetValueW RegCloseKey RegGetValueA RegQueryValueExW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-file-l1-1-0

GetFullPathNameA GetFileAttributesA GetDiskFreeSpaceA UnlockFile LockFileEx ReadFile DeleteFileW DeleteFileA SetEndOfFile GetFileType GetFileSizeEx SetFilePointer LockFile GetDiskFreeSpaceW GetTempFileNameW CreateFileA FlushFileBuffers UnlockFileEx SetFilePointerEx GetFileSize

msi

ord88

shell32

SHGetKnownFolderPath

kernel32

RtlCaptureContext GetCPInfo IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead UnhandledExceptionFilter GetSystemTimeAsFileTime SetUnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetTickCount64 GetCurrentProcess RtlLookupFunctionEntry TerminateProcess RtlVirtualUnwind QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileW WaitNamedPipeW CreateEventW WriteFile WaitForSingleObject CancelIo GetOverlappedResult CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx FormatMessageA LocalFree GetLocaleInfoEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo RtlPcToFileHeader RaiseException WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW

wininet

InternetReadFile InternetConnectA InternetQueryOptionW HttpQueryInfoA HttpSendRequestW HttpOpenRequestA InternetSetStatusCallbackW InternetCloseHandle InternetOpenW InternetCrackUrlA HttpAddRequestHeadersA

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW SetEnvironmentVariableW GetStdHandle GetEnvironmentStringsW GetCommandLineW GetCommandLineA SetStdHandle

api-ms-win-core-console-l1-1-0

GetConsoleMode WriteConsoleW ReadConsoleW GetConsoleOutputCP

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsFree FlsGetValue FlsAlloc

api-ms-win-core-memory-l1-1-0

CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile VirtualProtect

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime GetTimeZoneInformation

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetTickCount GetVersionExW GetSystemTime

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

iphlpapi

GetAdaptersInfo

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA LoadLibraryW

api-ms-win-core-file-l1-2-2

GetTempPathA

shlwapi

ord219

user32

TranslateMessage GetMessageW PostQuitMessage DispatchMessageW PostThreadMessageW

ole32

CoInitialize

version

GetFileVersionInfoSizeW

advapi32

SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl

oleaut32

SysFreeString SetErrorInfo GetErrorInfo SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_71ea96cd8af69933e6b840f7f90299aa_blankgrabber_icedid_luca-stealer_njrat_stealc

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

msi

shell32

kernel32

wininet

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

iphlpapi

crypt32

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-2-2

shlwapi

user32

ole32

version

advapi32

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-threadpool-l1-2-0

generic