blankgrabber | IttihadRAT v1[.]2[.]exe

resource	yara_rule
sample	blankgrabber_dmp

resource
IttihadRAT v1.2.exe
unpack001/bouncycastle.crypto.dll
unpack001/cgeoip.dll
unpack001/costura.dll
unpack001/dnlib.dll
unpack001/fastcoloredtextbox.dll
unpack001/iconextractor.dll
unpack001/mono.cecil.dll
unpack001/mono.cecil.mdb.dll
unpack001/mono.cecil.pdb.dll
unpack001/mono.cecil.rocks.dll
unpack001/mono.texttemplating.dll
unpack001/vestris.resourcelib.dll

resource
unpack001/guna.ui2.dll

IttihadRAT v1.2.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9eb9570bc20705b3da34f970b537067bea004ca863967567eea23db5d776e839
MD5 ada760f12e46ff53dcb8d95f092977e9
SHA1 833cd89a2d18f9f6fa95abb6ab144bf880b37c9d
SHA512 57fb6a7413c96c251170105fe5f296f1d228ad8bc72fc3fa83735b82bc60a245b05328d47964dce7c4bc0e798612ae578c2b80ea8652d03dadc5b2a88d0a38c9
SSDEEP 393216:/9FOgKbe5CrrrrrlRV7rrrw5rrrrrrMAO1eE0gsfqH13D7BIqh://fK65CrrrrrlRV7rrrYrrrrrrjtERT3
TLSH
T12527F11BB312A655D1CC433934D39B348F356C7A5B02460E7BED7D6E3BAA9A09B132C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

0

Major OS version

4

Entry point

20751742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bouncycastle.crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
MD5 f0b3e112ce4807a28e2b5d66a840ed7f
SHA1 54a6743781fd4ceb720331fce92f16186931192d
SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
TLSH
T132C53A1877F40613D6BAE7B595F09021A3F0F46EB393FB0B6591A7B50C13BA24C816A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2603454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

cgeoip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
MD5 6d6e172e7965d1250a4a6f8a0513aa9f
SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
TLSH
T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2411650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
MD5 d075a47a551e53e27889f83670a581e1
SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
TLSH
T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\costura\Costura\obj\Release\net40\Costura.pdb

dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
MD5 c087c70deb98db9d0b046d0a3d0e582a
SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
TLSH
T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1183806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/obj/Release/net45/dnlib.pdb

fastcoloredtextbox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
MD5 8610f4d3cdc6cc50022feddced9fdaeb
SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
TLSH
T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

336350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
MD5 b464fc896b14bfa34f608da53856e999
SHA1 55568eecc97895cad49a42bffe757e3588c5313c
SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
TLSH
T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 18, 2025

CN=Sobatdata Software

Minor OS version

0

Major OS version

4

Entry point

2188926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

iconextractor.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
MD5 640d8ffa779c6dd5252a262e440c66c0
SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
TLSH
T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb

mono.cecil.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c41bdb9ffd3c5f6e17d2382c1012d73703e035e3f1100245fdd4e08c8dc6eb5b
MD5 2f096535c228ab0d2082adfc01678481
SHA1 0e0dcb36aa56e7f99aa524cfb3c72e4918cc5b32
SHA512 9f54b9e85ef70afcb36569885de73bba704a8901c8ddbb5a35de6a1921d4d42f88026aea41ed77ec7a8041ee8a04efef817deda7dea0f29a716dab7a6ea7fd9e
SSDEEP 6144:LHNGIaxcvxT+2pEwMjbLmRlQ5+A45iziJCJP+pIoTtya:RRUQCmRw4szYCOI
TLSH
T165747B2167EC163BCADFA37BD06B042D46F9D015638FDB8D6D84A6F91C83FA65800267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

366574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\sources\cecil\obj\Release\net40\Mono.Cecil.pdb

mono.cecil.mdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 570a437dea0271d1d5c8b7d6a408b0b2635bdb0e8b8d5051878f3e7fca087f89
MD5 2c39a53a61168c8a7a9f53ebdad6137a
SHA1 b10ac8325cd72c7a9018af806d75739ab862b4d8
SHA512 d1987995bb58978a063a195a18ba02908edac02a3e7808e93f8340aa968c9bd74f76d2e6fad8158f72bc3629c1382039863471d51e510bd897187ccdabae8e14
SSDEEP 768:wlUj6BAKp/zgvVucdcRsCVKcraB09THkPFtQI4CRIzZwMNTBczwDN:0h3/zgvVPcRrK09HkBAwMNTNN
TLSH
T135132A1067AD9B27C2AD8AFDF482911507F09125B623FB9B9FC4F4EB6C47B85050227B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

49610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\sources\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb

mono.cecil.mdb.pdb

SHA256 66f96d1c188f913aad0192708aebfcc3c6e2c63fbdc6c5d842c80953e1df256f
MD5 2b45ebdea7a971e4f64f8330bafab9ef
SHA1 b1732bc5670d3d96f823fe58c61a9bd173f04267
SHA512 c485bcee4e1ad81798aa8c8de7202d6b2713991b45b26f792811804c948de6b2889569cf6b40ecf09bd8fa6f6ac3bbc7f5b4d9f9db85deef2207b8847b1f2649
SSDEEP 384:h7uKlfLRm61s9l2rUr/5oA3+yj7Z1aN2D6uiK2tmrNvnmBXiz1XNYpkUQBYukOVp:hrlfLRm61efVj7jaqugFBYuDKsv
TLSH
T1F182A526D2C98359CA06553B91B1931F73F6D1C4868F0F0683ACAB79BCE172872B7705
MD5 SHA1 SHA512 SSDEEP TLSH

Detects BlankGrabber stealer in memory

mono.cecil.pdb

SHA256 7731a001867c86c2db9ea12ebd6994ac7e43c7fd75bf1b5ee4f877601ef0bc43
MD5 a0a5f050d250250a3c35f549ea490758
SHA1 957cd18179d034981c8ec442b5d6bf1b706dd09b
SHA512 d9dee9065831d76507ac7a6e849247325118a893cf0901389c01131768a4ab9a88c3158065e849dfdf70cc430e1e291c54fcfbe5788221ab90cae15f0310c023
SSDEEP 3072:7KZVMXMzF07+QoVThIr+eGXqGsMXZQiqidougQQ:7eVMX16xVdIr+e61/7ouE
TLSH
T17204070AEB85A33DCA1D05B5645721D267F8C29EE58B4F0663ACF235B88B3187F43758
MD5 SHA1 SHA512 SSDEEP TLSH

Detects BlankGrabber stealer in memory

mono.cecil.pdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 50a1a1a79dc86fcfb8b51249b5325a10dd93d193c52999cf6775d25030a4e606
MD5 5f6a2f17f4e792600a13e3771d5ca5ff
SHA1 e411b8e51b201c5f389c2388d26735c1e89b3f6f
SHA512 67af09a5545c6bb0e033cfa09dfc654ce4cd4d22c418402d5a43612eaa6e60b71dca2bf4f796a6027c8e7aece88d418e6e8c469c94c327f5169608e67a3e7a39
SSDEEP 1536:TexPta15J8wWI7Kgl74TChe44tALYKXybJG3OoCkvV:TexFafB7q2hwArQJGFhvV
TLSH
T137937E3A9B98FA27C3ECAD7724A60D0907F1D126E153FB55C98959F8381BB301232797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

95466

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\sources\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb

mono.cecil.pdb.pdb

SHA256 0f8604853876a0355b9c855c22db2b9f6b96fb88eec0aa03c46d066b5c8a2b6b
MD5 3576bd11705ab3ffbeb9cbf6d6f6ee31
SHA1 b1e00349ea352a61c5b95405f5da44f75be0b4a5
SHA512 a1401a3aea98026fc37bda9ad4df5e3de83ceee5b1a147cc4e7dc973aebe50911e393a1979c3b06c2faf7435b06739e7a4138475fa534c276386d573b3a934c4
SSDEEP 384:PWGKULZ/97f1/xOP87/95dZ+LXd1Nj4WnRYU1TLCdTWhmtnsqMK3BdzvQ7+AWZO9:+GKk97f13ZSpjvR31ydcmKKk7+AJsaZL
TLSH
T1D7C29432EAB4C628C827873D81B68316B7F4C289A70B4B0F13ECE73D59977586D93645
MD5 SHA1 SHA512 SSDEEP TLSH

Detects BlankGrabber stealer in memory

mono.cecil.rocks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 842e09959084eda733aab1a5354d7af79e29594f4d8b91c8792103e5c755ed9b
MD5 e136924bb4051a462ad90bd14cb0ba41
SHA1 8cfeb4034766ce06f9216b1872703015e8ea0e09
SHA512 1baa852ffa42fd8a743661f003b90c840276b4cd864d5467b8d551454420ea46bb6c97e0dbe832de1e5e0672eb57365332dd5f86ad1df88820300504a3b1ea07
SSDEEP 768:628hQuem5RPkF+pXtRx/hRsPveQJcpAUdE3fF7Mtm3M:62gYm5RPv9jjsPveQCdEvF7Mtmc
TLSH
T1B2D229022B68CB77D6EF4575B8F0212842B1D39F6803C76E4DCC61E9A947B8567217F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\sources\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb

mono.cecil.rocks.pdb

SHA256 a186e51e8edda92120f1778866b3ee80d593ea2b66a0ce1bd47b48770e428fd6
MD5 ae72265225de42b6685f04d79c49725e
SHA1 eecdee534a3467e3ea6876fe854be8f82e1223ab
SHA512 89aa71b6ac3578a13ca42ba15a9d69ce30e647fb284635565c7f6c57c48c2383a025b2101e0054376724530547526612ba715971bf325978cccafc6dc264e022
SSDEEP 192:b0SDGk0r6RoDxddtmMtnlxSaKsFshUhaBKldUMi0DEyKKJmVpF+V:b0SSzCWlxsv2haBKQ7040mFO
TLSH
T1DB129207FAF8CF6DC94A08B9D262531977B0C75CD306071492A7E274ED8A39923B2B64
MD5 SHA1 SHA512 SSDEEP TLSH

Detects BlankGrabber stealer in memory

mono.texttemplating.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ab59b090275e66a6d31560fb8e82b08ffc4c6b5531392f307178c42681a52c9
MD5 a902ed14c16a0713b31ae42a36bcc482
SHA1 b020133cf85da24a4b527a44a5634e5203eaa65f
SHA512 4447dc5cff9de98422e3904d3d8c4c251d3144eedff83d621d9aee538972a45ac8b5331000b97d52cf32b3cb3ed8e13693cf4c70e0cd04335a5c1ba780449391
SSDEEP 3072:Yesac/pAhHg07rSjJooBK7665laKZ8oeVnLNk0DtcvvLXpyqDThDz8Birn:PgAhHgeS0665MKZ2LNLmLXkqXhz8Bir
TLSH
T1CD045A2813EC4B66E7FF5B38F834901146B1F966A926D7AE0D04A5ED1D13B40E921FB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

179474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Mono.TextTemplating.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory

Digest

08:39:56:e4:21:43:4f:90:03:ee:08:ba:76:09:c5:58:d4:a5:2a:73:28:78:a1:5f:f6:46:d6:59:61:a9:2a:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 16, 2025

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2024 - Nov 3, 2027

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Minor OS version

0

Major OS version

4

Entry point

713798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

vestris.resourcelib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
MD5 944ce5123c94c66a50376e7b37e3a6a6
SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
TLSH
T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects BlankGrabber stealer in memory
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

83158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb

Sharing

General

Malware Config

Signatures

File Explorer

IttihadRAT v1.2.exe

mscoree

dotnet

bouncycastle.crypto.dll

mscoree

dotnet

cgeoip.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

dnlib.dll

mscoree

dotnet

fastcoloredtextbox.dll

mscoree

dotnet

guna.ui2.dll

PE Signature issue

mscoree

dotnet

iconextractor.dll

mscoree

dotnet

mono.cecil.dll

mscoree

dotnet

mono.cecil.mdb.dll

mscoree

dotnet

mono.cecil.mdb.pdb

mono.cecil.pdb

mono.cecil.pdb.dll

mscoree

dotnet

mono.cecil.pdb.pdb

mono.cecil.rocks.dll

mscoree

dotnet

mono.cecil.rocks.pdb

mono.texttemplating.dll

mscoree

dotnet

newtonsoft.json.dll

mscoree

dotnet

vestris.resourcelib.dll

mscoree

dotnet