2026-10-23_01901ed64d6f6e797dfb22e9917b53f5_blankgrabber_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_01901ed64d6f6e797dfb22e9917b53f5_blankgrabber_icedid_njrat
Size 16.6MB
Sample261023-s2hpvact9v
SHA256 f988495635b18f643c25a51ebe3570361c5d2482177782b7be0e9a9f25cdd426
MD5 01901ed64d6f6e797dfb22e9917b53f5
SHA1 f219bebc9aff1df8945e23bd4da7a9eb4183e6b0
SHA512 bf1b00abe8721a559ea2fc8509923979fab201b7432552259a24253f8ef3ca1551a9c79a9db35f2c049b7920c91f808b57e3b5b1e38c676f5001e70909abcb87
SSDEEP 196608:qPztRIWBZgmHFpKDgmMepqMWhqPWql8IDO2qjqzARXYYUA:6hBOjtLuBhZRqA
TLSH
T1D2074B0AF3B640E1D1BAC038D553A73BFC6134598738A7DB87818F969B61BE09A3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_01901ed64d6f6e797dfb22e9917b53f5_blankgrabber_icedid_njrat

File Explorer

2026-10-23_01901ed64d6f6e797dfb22e9917b53f5_blankgrabber_icedid_njrat

.exe 16.6MB

2026-10-23_01901ed64d6f6e797dfb22e9917b53f5_blankgrabber_icedid_njrat

IMPHASH 9dd866514f97dc09aae3cf4669fbf401
SHA256 f988495635b18f643c25a51ebe3570361c5d2482177782b7be0e9a9f25cdd426
MD5 01901ed64d6f6e797dfb22e9917b53f5
SHA1 f219bebc9aff1df8945e23bd4da7a9eb4183e6b0
SHA512 bf1b00abe8721a559ea2fc8509923979fab201b7432552259a24253f8ef3ca1551a9c79a9db35f2c049b7920c91f808b57e3b5b1e38c676f5001e70909abcb87
SSDEEP 196608:qPztRIWBZgmHFpKDgmMepqMWhqPWql8IDO2qjqzARXYYUA:6hBOjtLuBhZRqA
TLSH
T1D2074B0AF3B640E1D1BAC038D553A73BFC6134598738A7DB87818F969B61BE09A3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6761696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Users\admin\Desktop\dev\cpp\ignite\loader\x64\Debug\loader.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA GlobalAlloc GlobalUnlock GlobalLock GlobalFree CreateProcessA RtlAddFunctionTable RtlLookupFunctionEntry FlushInstructionCache VirtualProtectEx ReadProcessMemory GetCurrentProcessId InitOnceBeginInitialize FormatMessageA IsWow64Process UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList ProcessIdToSessionId GetProcessHeap HeapFree HeapAlloc SetCurrentDirectoryA MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx DecodePointer VirtualFreeEx WriteProcessMemory VirtualAllocEx GetExitCodeThread SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleOutputCP HeapQueryInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VerSetConditionMask GetDateFormatW VirtualProtect IsThreadAFiber GetTimeZoneInformation SetConsoleCtrlHandler UnhandledExceptionFilter IsProcessorFeaturePresent ExitProcess Process32Next Process32First CreateToolhelp32Snapshot CreateRemoteThread GetExitCodeProcess TerminateProcess WaitForSingleObject CreateFileA WideCharToMultiByte GetComputerNameW GetSystemTime OpenProcess LocalFree SetLastError FreeConsole GetActiveProcessorCount GetActiveProcessorGroupCount GetFirmwareType SetThreadGroupAffinity GetThreadGroupAffinity GetCurrentThread GetCurrentProcess GetLastError GetFileSize FlushFileBuffers GetWindowsDirectoryW GetTickCount64 Sleep CloseHandle SetFileInformationByHandle ReadFile GetFileType GetFileInformationByHandle FindNextFileW FindFirstFileW WriteConsoleW HeapValidate FreeLibraryAndExitThread ExitThread GetModuleHandleExW FlsFree FlsSetValue FlsGetValue FlsAlloc LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList SetConsoleMode GetConsoleMode FindClose CreateFileW CompareFileTime GetTimeFormatW WTSGetActiveConsoleSessionId GetStdHandle SetFilePointerEx GetLogicalDrives GetDriveTypeW GetVolumePathNameW FindVolumeClose FindNextVolumeW FindFirstVolumeW FileTimeToSystemTime GetFileTime CopyFileW GetWindowsDirectoryA GetFileAttributesA SetComputerNameExW GetComputerNameExW SetEndOfFile GetSystemFirmwareTable CreateMutexW ReleaseMutex HeapSize HeapDestroy VirtualQuery InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetSystemInfo VirtualQueryEx InitOnceComplete SetThreadContext GetThreadContext GetThreadTimes SuspendThread OpenThread LoadLibraryW GetFileSizeEx HeapReAlloc MapViewOfFile UnmapViewOfFile CreateFileMappingA WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetLogicalProcessorInformationEx GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileTime GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo OpenFileMappingA IsDebuggerPresent OutputDebugStringW RaiseException GetSystemTimeAsFileTime Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection InitializeCriticalSection ResumeThread CreateProcessW VirtualAlloc VirtualFree Process32FirstW Process32NextW GetModuleFileNameW FormatMessageW DeleteFileW GetTempFileNameW WriteFile CreateFileMappingW CreateActCtxW ReleaseActCtx GetNativeSystemInfo OutputDebugStringA DuplicateHandle ResetEvent GetTickCount GetEnvironmentVariableW GetSystemDirectoryW GetSystemWow64DirectoryW ActivateActCtx DeactivateActCtx Module32FirstW GetProcessId ConnectNamedPipe CreateNamedPipeW CreateThread TerminateThread Thread32First Thread32Next ContinueDebugEvent WaitForDebugEvent DebugActiveProcess DebugActiveProcessStop CheckRemoteDebuggerPresent DebugSetProcessKillOnExit

user32

IsWindowUnicode GetForegroundWindow GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetWindowThreadProcessId EnumWindows UnregisterClassA MessageBoxA SetCapture GetWindowRect wsprintfW CallWindowProcA MapVirtualKeyA GetClientRect SetCursorPos SetCursor SetWindowRgn GetCapture IsIconic IsWindow ReleaseCapture ExitWindowsEx GetKeyState UnregisterClassW GetCursorPos UpdateWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExA RegisterClassExA ClientToScreen DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDPIAware MonitorFromWindow LoadCursorA ScreenToClient PostQuitMessage

gdi32

DeleteObject CreateRectRgn CreateRoundRectRgn

advapi32

RegCreateKeyW RegEnumKeyExW RegDeleteValueW StartServiceW QueryServiceStatus OpenServiceW RegOpenKeyA RegCreateKeyA LookupAccountSidA SetTokenInformation RevertToSelf IsWellKnownSid ImpersonateLoggedOnUser GetTokenInformation DuplicateTokenEx CreateProcessAsUserA OpenThreadToken OpenServiceA OpenSCManagerA DeleteService CreateServiceA CloseServiceHandle RegSetValueExA RegOpenKeyExW RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorA RegSetKeySecurity RegCreateKeyExA RegGetValueW RegSetValueExW RegQueryValueExW RegOpenKeyW RegCreateKeyExW RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegGetValueA OpenSCManagerW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW LookupPrivilegeValueW RegDeleteKeyW RegSetKeyValueW ChangeServiceConfigW ControlService CreateServiceW EnumDependentServicesW RegRenameKey

shell32

ShellExecuteExA ShellExecuteA

shlwapi

SHDeleteKeyW SHDeleteKeyA

ole32

CoUninitialize CoCreateInstance CoInitialize CoInitializeEx CoSetProxyBlanket

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

bcrypt

BCryptGenRandom

cfgmgr32

CM_Locate_DevNodeW CM_Get_DevNode_Status

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiSetClassInstallParamsW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW

wtsapi32

WTSSendMessageA WTSQueryUserToken

d3dcompiler_43

D3DCompile

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

ncrypt

NCryptOpenStorageProvider NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey NCryptImportKey NCryptExportKey NCryptSignHash NCryptFreeObject

ntdll

RtlPcToFileHeader RtlUnwindEx RtlUnwind RtlCaptureContext RtlVirtualUnwind RtlInitUnicodeString NtQuerySystemInformation

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

Name

.text

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

118KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

476KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

754KB

Virtual Size

753KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_01901ed64d6f6e797dfb22e9917b53f5_blankgrabber_icedid_njrat

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

d3dx11_43

d3d11

bcrypt

cfgmgr32

iphlpapi

setupapi

wtsapi32

d3dcompiler_43

dwmapi

ncrypt

ntdll

oleaut32

generic