2026-08-08_2df41d4163992f9af1e45d4899853a9f_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_2df41d4163992f9af1e45d4899853a9f_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 5.1MB
Sample260808-efmj1sbf24
SHA256 ccc9ea2a9319a8d9ff4071f27b6f3ec4be8cbb753b406850e8f73ad9d27dd47c
MD5 2df41d4163992f9af1e45d4899853a9f
SHA1 1267e56778710872acf731100b56cf110cb34dfe
SHA512 890c71c214d1d030d79d14f62bb6afb1c0400975614233e153350cb4ab92996102049b8d69dc07f3061f5233cdce483cc3f6fdf1fab5ea87ecad1daf5b5ce6b4
SSDEEP 98304:Ij72nLSoTOliwqFDHe7dI9tdeNQQYHzxCsDDMc5dCNS7wNwD11rRHj7esfxb3:If2nLdaliwqFDHIdytyYTxz0cDCNS7hb
TLSH
T11D360149D69701ACCD7AD8F9DA4640A3C376B4EA8334F9EB13D671121FDA5F0993AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_2df41d4163992f9af1e45d4899853a9f_blankgrabber_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-08_2df41d4163992f9af1e45d4899853a9f_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 5.1MB

2026-08-08_2df41d4163992f9af1e45d4899853a9f_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH 87b9654b6c6a1443f5113a950dfa58d7
SHA256 ccc9ea2a9319a8d9ff4071f27b6f3ec4be8cbb753b406850e8f73ad9d27dd47c
MD5 2df41d4163992f9af1e45d4899853a9f
SHA1 1267e56778710872acf731100b56cf110cb34dfe
SHA512 890c71c214d1d030d79d14f62bb6afb1c0400975614233e153350cb4ab92996102049b8d69dc07f3061f5233cdce483cc3f6fdf1fab5ea87ecad1daf5b5ce6b4
SSDEEP 98304:Ij72nLSoTOliwqFDHe7dI9tdeNQQYHzxCsDDMc5dCNS7wNwD11rRHj7esfxb3:If2nLdaliwqFDHIdytyYTxz0cDCNS7hb
TLSH
T11D360149D69701ACCD7AD8F9DA4640A3C376B4EA8334F9EB13D671121FDA5F0993AB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

549104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2049a_D20260728T161528\fa_rss\x64\Release\Setup.pdb

advapi32

QueryServiceObjectSecurity ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW RegOpenKeyExW StartServiceW RegSetValueExW ControlService SetServiceObjectSecurity DeleteService RegCreateKeyExW ConvertSecurityDescriptorToStringSecurityDescriptorW ChangeServiceConfig2W OpenSCManagerW CloseServiceHandle RegCloseKey CreateServiceW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW RegEnumKeyExW RegDeleteValueW RegDeleteTreeW RegDeleteKeyExW MapGenericMask DuplicateToken CheckTokenMembership FreeSid OpenProcessToken GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW AllocateAndInitializeSid AccessCheck GetSecurityInfo

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest

wininet

InternetReadFile InternetCloseHandle HttpSendRequestW InternetOpenW InternetOpenUrlW HttpOpenRequestW InternetConnectW

comctl32

InitCommonControlsEx ord412 ord410 ord413 PropertySheetW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoInitializeSecurity CoInitialize

shell32

ShellExecuteW ord155 ord190 CommandLineToArgvW SHGetKnownFolderPath SHBrowseForFolderW ShellExecuteExW SHGetPathFromIDListW

kernel32

EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW RaiseException InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleFileNameW GetTempPathW CloseHandle LocalFree CreateProcessW ExpandEnvironmentStringsA GetUserDefaultUILanguage LCIDToLocaleName OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId WideCharToMultiByte QueryFullProcessImageNameW GetCurrentThreadId GetCommandLineW CreateMutexW OpenEventW Sleep GetLastError SetEvent GetTempFileNameW MoveFileW SizeofResource LockResource LoadResource FindResourceW ReadFile FindFirstFileExW FindNextFileW GetCurrentProcess WriteFile TerminateProcess RemoveDirectoryW CreateNamedPipeW InitializeProcThreadAttributeList FindClose WaitForSingleObject CreateFileW GetFileAttributesW HeapReAlloc MultiByteToWideChar GetTickCount64 UpdateProcThreadAttribute DeleteFileW DeleteProcThreadAttributeList ExitProcess WaitNamedPipeW ConnectNamedPipe FlushFileBuffers GetSystemFirmwareTable GetModuleHandleW MulDiv LoadLibraryW MoveFileExW GetFileAttributesExW SetFileAttributesW GetFileType GetTickCount GetFileSizeEx GetFileTime SetFilePointerEx GetSystemTimeAsFileTime GetCPInfo CompareStringEx QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection TryAcquireSRWLockExclusive TlsGetValue AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx GetStringTypeW GetLocaleInfoEx FormatMessageA CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetProcAddress DeviceIoControl AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileW CreateDirectoryW TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc ReadConsoleW DisconnectNamedPipe

user32

GetWindowDC UpdateWindow EnableWindow GetWindowLongW GetKeyState GetWindowRect InflateRect MonitorFromWindow FillRect GetSystemMetrics SetWindowTextW GetCapture DestroyIcon GetDlgCtrlID MapWindowPoints TrackMouseEvent IsWindowEnabled SetWindowLongW GetDlgItem DrawIconEx PtInRect LoadImageW InvalidateRect BeginPaint EndPaint RegisterClassW GetDC SetWindowPos SetWindowLongPtrW UnregisterClassW FrameRect GetWindowLongPtrW LoadCursorW SetCursor DrawTextW GetSysColorBrush GetParent ReleaseDC GetWindowTextW GetWindowThreadProcessId GetShellWindow MessageBoxExW ShowWindow SetFocus SetForegroundWindow GetMessageW ScreenToClient CallNextHookEx WindowFromPoint IsWindow DispatchMessageW IsChild GetForegroundWindow UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostThreadMessageW GetCursorPos MonitorFromPoint GetMonitorInfoW EnumDisplaySettingsW DefWindowProcW SetDlgItemTextW RedrawWindow OffsetRect EnableMenuItem KillTimer SetTimer DestroyWindow GetSystemMenu IsWindowVisible SendMessageW GetSysColor CreateWindowExW PostMessageW GetClientRect

gdi32

CreateCompatibleDC GetStockObject DeleteDC CreatePen SetBkColor CreateSolidBrush CreateCompatibleBitmap SelectObject GetDeviceCaps SetTextColor SetBkMode DeleteObject CreateFontIndirectW BitBlt GetObjectW GetNearestColor CreateDIBSection RoundRect

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shlwapi

PathFindFileNameW

iphlpapi

GetAdaptersInfo

uxtheme

SetWindowTheme

bcrypt

BCryptFinishHash BCryptCreateHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptHashData BCryptEncrypt BCryptDestroyHash BCryptDestroyKey

ntdll

RtlCaptureContext RtlPcToFileHeader RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlUnwind

Name

.text

Size

769KB

Virtual Size

769KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

216KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_2df41d4163992f9af1e45d4899853a9f_blankgrabber_icedid_luca-stealer_njrat_stealc

advapi32

winhttp

wininet

comctl32

ole32

shell32

kernel32

user32

gdi32

oleaut32

shlwapi

iphlpapi

uxtheme

bcrypt

ntdll

generic