2026-10-07_ff64702ac58c27225b94ca4bf47ee698_blankgrabber_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-07_ff64702ac58c27225b94ca4bf47ee698_blankgrabber_icedid_njrat
Size 4.6MB
Sample261007-3rr6msht6l
SHA256 4a0f3b8a475ad80d26e6f7882bbf4732d1081745808d0b895a7b1669364dab2d
MD5 ff64702ac58c27225b94ca4bf47ee698
SHA1 90c4f9ff4da6dbb750d0793ac82ac18b1dd82b76
SHA512 67bd0e5cdf01a4d8a76a650b4a8cd044bbc1ff53a3ba74530b0d9861d3697a73169c64d894dc2faf930785ab92d3d6db27562f877a4a2d8eeb7acc4353a14c04
SSDEEP 49152:5PRhvt8tUOsSV6gJVZ/WvoVtuxJL5BdAIFTlLhqwYO2nxAdfOfdu9aEsR2TPod5G:Phv631Vtu/rlu2Tc5TkSXYVN2Tc5
TLSH
T14136D02A326811E4E177C17EC6CB8E46D6B2340A03615BCF059597AD1F27EEC4E7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-07_ff64702ac58c27225b94ca4bf47ee698_blankgrabber_icedid_njrat

File Explorer

2026-10-07_ff64702ac58c27225b94ca4bf47ee698_blankgrabber_icedid_njrat

.exe 4.6MB

2026-10-07_ff64702ac58c27225b94ca4bf47ee698_blankgrabber_icedid_njrat

IMPHASH 48d5dafb6eb3deeec10d92c245a14ad1
SHA256 4a0f3b8a475ad80d26e6f7882bbf4732d1081745808d0b895a7b1669364dab2d
MD5 ff64702ac58c27225b94ca4bf47ee698
SHA1 90c4f9ff4da6dbb750d0793ac82ac18b1dd82b76
SHA512 67bd0e5cdf01a4d8a76a650b4a8cd044bbc1ff53a3ba74530b0d9861d3697a73169c64d894dc2faf930785ab92d3d6db27562f877a4a2d8eeb7acc4353a14c04
SSDEEP 49152:5PRhvt8tUOsSV6gJVZ/WvoVtuxJL5BdAIFTlLhqwYO2nxAdfOfdu9aEsR2TPod5G:Phv631Vtu/rlu2Tc5TkSXYVN2Tc5
TLSH
T14136D02A326811E4E177C17EC6CB8E46D6B2340A03615BCF059597AD1F27EEC4E7E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29321

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ContainerAdministrator\.conan2\p\b\sentrdd00dd4c88a41\b\build\crashpad_build\handler\RelWithDebInfo\crashpad_handler.pdb

powrprof

CallNtPowerInformation

user32

GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW RegisterClassW UnregisterClassW CreateWindowExW DestroyWindow GetWindowLongPtrW SetWindowLongPtrW IsWindowVisible GetDC ReleaseDC GetShellWindow GetWindow

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpQueryHeaders WinHttpReadData WinHttpWriteData WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse

advapi32

RegCloseKey RegQueryValueExA RegQueryValueExW ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction036 RegOpenKeyExW

kernel32

AddVectoredExceptionHandler GetFileAttributesW DeleteFileW CreateDirectoryW WriteConsoleW ReadConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SleepEx Sleep GetExitCodeThread CreateProcessW FlushInstructionCache VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule GetFileTime RemoveDirectoryW SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler GetProcessTimes SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext GetModuleHandleW GetProcAddress VerSetConditionMask IsProcessorFeaturePresent GetSystemInfo VerifyVersionInfoW GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID GetModuleFileNameW MoveFileExW GetLastError ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateThread OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx SetLastError IsWow64Process FormatMessageA VirtualQueryEx ReadProcessMemory GetSystemTimeAsFileTime LoadLibraryW FindClose CloseHandle RemoveVectoredExceptionHandler LocalFree CreateFileW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW GetStdHandle GetFileSizeEx GetFileType LockFileEx ReadFile SetEndOfFile SetFilePointerEx UnlockFileEx WriteFile GetNamedPipeInfo OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW GetFullPathNameW LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection IsValidCodePage InitializeCriticalSection InitOnceBeginInitialize InitOnceComplete RtlUnwind GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetCurrentDirectoryW GetCurrentDirectoryW DuplicateHandle EnterCriticalSection WideCharToMultiByte InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW GetCurrentThread HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW HeapReAlloc HeapSize HeapQueryInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW FindNextFileW

gdi32

SelectObject CreateCompatibleBitmap CombineRgn CreateCompatibleDC CreateRectRgn CreateRectRgnIndirect DeleteDC DeleteObject GetRgnBox OffsetRgn SelectClipRgn BitBlt

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

435KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-07_ff64702ac58c27225b94ca4bf47ee698_blankgrabber_icedid_njrat

powrprof

user32

version

winhttp

advapi32

kernel32

gdi32

generic