2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat
Size 2.9MB
Sample260910-n8lymagg39
SHA256 8da388c7f73fd839c3ea91b9829d06611a4489917ed227daf5956370c345e83a
MD5 afa66d4dc8d294eaaf6ecae6d5273bdf
SHA1 4ec1aea341f56b2cb4b4b91349b81d6c191c180d
SHA512 a55c38dc383f4a0272be499be9776186c7c1d72d17505879cf5453dc56495bf2c88dada2ed6c891a12b5baf02e1f71bcc0c572c8e069f1fa5d21d979c031d2c8
SSDEEP 49152:X42+N95fUnYyAfd/LKydunkoeby+1bK2tnp/CXjKXi0aj3JWkZTaDmg27RnWGj:I55mey++TaD527BWG
TLSH
T1FDE59E6E66A405FCD1EBC1BACA4ADD13D772740F13B0A75F07A185622F5B2208A7D723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat

File Explorer

2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat

.exe 2.9MB

2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat

IMPHASH ed251086d2b7468967b459c3369e3c78
SHA256 8da388c7f73fd839c3ea91b9829d06611a4489917ed227daf5956370c345e83a
MD5 afa66d4dc8d294eaaf6ecae6d5273bdf
SHA1 4ec1aea341f56b2cb4b4b91349b81d6c191c180d
SHA512 a55c38dc383f4a0272be499be9776186c7c1d72d17505879cf5453dc56495bf2c88dada2ed6c891a12b5baf02e1f71bcc0c572c8e069f1fa5d21d979c031d2c8
SSDEEP 49152:X42+N95fUnYyAfd/LKydunkoeby+1bK2tnp/CXjKXi0aj3JWkZTaDmg27RnWGj:I55mey++TaD527BWG
TLSH
T1FDE59E6E66A405FCD1EBC1BACA4ADD13D772740F13B0A75F07A185622F5B2208A7D723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spotify_cli.pdb

user32

AllowSetForegroundWindow

advapi32

BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction036 BuildSecurityDescriptorW

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteW

gdiplus

GdipDrawImageRectRectI GdipCreateBitmapFromScan0 GdipSetInterpolationMode GdipCloneImage GdipDisposeImage GdipBitmapLockBits GdipGetImageHeight GdipBitmapUnlockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImageWidth GdipFree GdipAlloc GdiplusStartup

ws2_32

getsockopt WSAIoctl ntohl htons WSAStringToAddressW WSASocketW WSASend WSAStartup WSACleanup __WSAFDIsSet accept bind closesocket connect ioctlsocket getsockname WSAGetLastError htonl listen select setsockopt shutdown WSASetLastError WSARecv

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread QueueUserAPC GetExitCodeProcess TerminateProcess ExitProcess GetCurrentProcess ResumeThread ExitThread TerminateThread TlsFree TlsSetValue TlsGetValue TlsAlloc CreateProcessW GetExitCodeThread GetStartupInfoW GetCurrentThreadId GetCurrentProcessId CreateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetVersion GetTickCount64 GetLocalTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlUnwind RtlPcToFileHeader

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetLastError RaiseException SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW GetProcAddress FreeLibrary GetModuleHandleW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection LeaveCriticalSection SetWaitableTimer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TryAcquireSRWLockExclusive SleepEx WaitForSingleObject SetEvent ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObjectEx CreateEventW InitializeCriticalSectionEx InitializeCriticalSection

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle FreeEnvironmentStringsW GetStdHandle GetCurrentDirectoryW GetCommandLineA GetCommandLineW SetEnvironmentVariableW GetEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CreateFileW LockFileEx GetFileAttributesExW GetFullPathNameW WriteFile DeleteFileW SetEndOfFile GetDriveTypeW UnlockFileEx CreateDirectoryW RemoveDirectoryW SetFilePointerEx GetFileSizeEx FindFirstFileW FindClose FindFirstFileExW FindNextFileW ReadFile GetFileInformationByHandle GetFileType FlushFileBuffers GetFileAttributesW GetFileTime

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize GetProcessHeap

api-ms-win-core-localization-l1-2-0

LCMapStringEx IsValidLocale GetLocaleInfoEx EnumSystemLocalesW FormatMessageW GetLocaleInfoW IsValidCodePage LCMapStringW GetACP GetUserDefaultLCID FormatMessageA GetOEMCP GetCPInfo

api-ms-win-core-string-l1-1-0

MultiByteToWideChar CompareStringW WideCharToMultiByte GetStringTypeW

api-ms-win-core-fibers-l1-1-0

FlsGetValue FlsAlloc FlsSetValue FlsFree

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleOutputCP SetConsoleCtrlHandler

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-io-l1-1-0

PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatus CancelIoEx

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW WaitForMultipleObjects

api-ms-win-core-errorhandling-l1-1-1

RemoveVectoredExceptionHandler AddVectoredExceptionHandler

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW Sleep InitOnceComplete InitOnceBeginInitialize

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject CreateJobObjectW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW TransactNamedPipe

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-toolhelp-l1-1-0

Process32NextW Process32FirstW CreateToolhelp32Snapshot

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation SystemTimeToTzSpecificLocalTime FileTimeToSystemTime

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

327KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat

user32

advapi32

shell32

gdiplus

ws2_32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic