2026-10-30_7dda6812861dd130bd616f3c0cb2dde3_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_7dda6812861dd130bd616f3c0cb2dde3_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 3.1MB
Sample261030-3t8w6sswhy
SHA256 fdbc7f2046b7569c97903392119f3501d371907d5dec136d4dfb214f81d2618b
MD5 7dda6812861dd130bd616f3c0cb2dde3
SHA1 e5e0d9503c27c6b41083c406164c7f832e4be522
SHA512 ed9b97e562532d3b8e6ebcd5629ea23e970bd47ecbbb96353ee9ed3890e12d6602ccbf5329fb9869bf8b08ce1c995696eefc0458a68915a9f1b4e7cf3fdad3c5
SSDEEP 49152:qvig3jiW+mlrZFHq/6JVbw8mLpPv6uC/Sue3j1HLQDth:m/zhlVC3j1K
TLSH
T1EAE57D56629C01E5E1B6C179CA8F8923EB723C0503A19BDF01A0F6661F7B9E14B7E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-30_7dda6812861dd130bd616f3c0cb2dde3_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 3.1MB

2026-10-30_7dda6812861dd130bd616f3c0cb2dde3_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH b48920857c1551cacb1388d240b6ea33
SHA256 fdbc7f2046b7569c97903392119f3501d371907d5dec136d4dfb214f81d2618b
MD5 7dda6812861dd130bd616f3c0cb2dde3
SHA1 e5e0d9503c27c6b41083c406164c7f832e4be522
SHA512 ed9b97e562532d3b8e6ebcd5629ea23e970bd47ecbbb96353ee9ed3890e12d6602ccbf5329fb9869bf8b08ce1c995696eefc0458a68915a9f1b4e7cf3fdad3c5
SSDEEP 49152:qvig3jiW+mlrZFHq/6JVbw8mLpPv6uC/Sue3j1HLQDth:m/zhlVC3j1K
TLSH
T1EAE57D56629C01E5E1B6C179CA8F8923EB723C0503A19BDF01A0F6661F7B9E14B7E713
MD5 SHA1 SHA512 SSDEEP TLSH

PE Signature issue

Digest

a3:b8:d0:11:83:2f:83:25:70:5f:3d:d7:17:44:89:9e:09:34:b9:92:ec:ab:4a:9a:e9:d5:e7:9a:22:46:c9:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Chains

Oct 12, 2026

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Digest

a3:b8:d0:11:83:2f:83:25:70:5f:3d:d7:17:44:89:9e:09:34:b9:92:ec:ab:4a:9a:e9:d5:e7:9a:22:46:c9:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

Chains

Oct 12, 2026

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

Serial Number

0b:c0:cf:65:cd:f1:b3:ea:30:86:48:8a:09:ba:aa:a0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2026 - Oct 8, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

02:6c:8d:34:96:d7:b7:72:05:df:dd:e5:c1:e1:64:65:0c:c5:a5:09

Issuer

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2026 - Jul 14, 2027

Subject

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2020 - Jul 17, 2030

Subject

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

3d:1f:d8:47:f9:7a:4d:60:55:54:9f:7c:d2:22:cf:46:53:9e:7b:34

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 15, 2020 - Jul 15, 2045

Subject

CN=ESET Timestamp,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

1d:24:b6:6c:99:3c:6f:c9:ba:b9:52:a8:f7:29:ee:31:1b:c0:21:12

Issuer

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 14, 2026 - Jul 15, 2027

Subject

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2020 - Jul 16, 2030

Minor OS version

Major OS version

Entry point

1979616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Bootstrapper.pdb

rpcrt4

UuidCreate

kernel32

WriteConsoleW HeapSize SetLastError InitializeCriticalSection GetTickCount GetModuleHandleW GetSystemTimeAsFileTime GetLastError GetCurrentThread GetCurrentProcess VerSetConditionMask VerifyVersionInfoW LoadLibraryW FreeLibrary GetProcAddress FindFirstFileW FindClose LocalFree WideCharToMultiByte MultiByteToWideChar FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDateFormatW GetSystemTime GetTimeFormatW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject ResetEvent GetCurrentProcessId Sleep FindFirstFileExW FindNextFileW RemoveDirectoryW CreateDirectoryW LoadLibraryExW WaitForMultipleObjects ReadFile WriteFile SetEndOfFile SetFilePointer GetFileSize DeleteFileW GetFileInformationByHandle MoveFileW CopyFileW GetTempPathW GetTempFileNameW FlushFileBuffers GetSystemInfo MapViewOfFile UnmapViewOfFile QueryPerformanceCounter QueryPerformanceFrequency VirtualAlloc VirtualFree VirtualProtect TryEnterCriticalSection GetCurrentThreadId CreateSemaphoreW ReleaseSemaphore GetExitCodeThread SystemTimeToFileTime MoveFileExW GetCurrentDirectoryW FindResourceW SizeofResource LoadResource LockResource ExpandEnvironmentStringsW GetEnvironmentVariableW GetVersion GetLocaleInfoW GetTimeZoneInformation GetModuleFileNameW OpenProcess GetProcessHeap HeapAlloc HeapFree CreateMutexW ReleaseMutex CreateProcessW GetExitCodeProcess GetCommandLineW GetComputerNameW GetSystemDirectoryW CreateMutexA OpenMutexA FlushViewOfFile SwitchToThread RaiseException VirtualQuery LoadLibraryExA GetEnvironmentVariableA GetFullPathNameW SleepEx WaitForSingleObjectEx FormatMessageW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle ReadConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle ExitProcess PeekNamedPipe GetFileType TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo FormatMessageA GetLocaleInfoEx GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetStringTypeW LCMapStringEx

ws2_32

gethostbyname WSAGetLastError WSAIoctl WSACloseEvent WSACreateEvent WSASetEvent WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAEnumNetworkEvents WSASetLastError WSACleanup WSAStartup shutdown select __WSAFDIsSet accept listen bind connect getsockname ioctlsocket setsockopt getsockopt sendto send recvfrom recv closesocket socket gethostbyaddr getservbyport ntohs inet_ntoa htonl getservbyname htons inet_addr

shell32

CommandLineToArgvW

ole32

StringFromGUID2

wintrust

CryptSIPGetSignedDataMsg

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_7dda6812861dd130bd616f3c0cb2dde3_blankgrabber_icedid_luca-stealer_njrat_stealc

PE Signature issue

rpcrt4

kernel32

ws2_32

shell32

ole32

wintrust

generic