2026-10-28_7e5860f678a55e4aa1e8b12442117855_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_7e5860f678a55e4aa1e8b12442117855_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 4.7MB
Sample261030-bheemsvtbx
SHA256 c3e89faf8741e782ae1deba95374d5a3d5ee193e3a091b5b35e187764c5dfbd7
MD5 7e5860f678a55e4aa1e8b12442117855
SHA1 8ba2ae9d35fb392ae365563ffec8de85d8324333
SHA512 76828646ada61a4fa4d99e9441a0417e50fe22a093ee3418aee98229a2bfa4a211308d21673b1f6f8d77a6c2c7b1c9d512b5a200c1e47c6288eda2c4cb440c8d
SSDEEP 98304:LM6SD/LXhPHSEh6mzFg0r776X5D8vtysb684j1fg/uRXaVbgw8:LM6SDhPyE8me0rv6pIv9EjFwwa2w8
TLSH
T1AF360209E5EB01F4DCABC2FD8B825417D7B278454738D5EB0291AB561F9BEE08E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_7e5860f678a55e4aa1e8b12442117855_blankgrabber_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-28_7e5860f678a55e4aa1e8b12442117855_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 4.7MB

2026-10-28_7e5860f678a55e4aa1e8b12442117855_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH 9c9b7e6e447e857410077bab976ce218
SHA256 c3e89faf8741e782ae1deba95374d5a3d5ee193e3a091b5b35e187764c5dfbd7
MD5 7e5860f678a55e4aa1e8b12442117855
SHA1 8ba2ae9d35fb392ae365563ffec8de85d8324333
SHA512 76828646ada61a4fa4d99e9441a0417e50fe22a093ee3418aee98229a2bfa4a211308d21673b1f6f8d77a6c2c7b1c9d512b5a200c1e47c6288eda2c4cb440c8d
SSDEEP 98304:LM6SD/LXhPHSEh6mzFg0r776X5D8vtysb684j1fg/uRXaVbgw8:LM6SDhPyE8me0rv6pIv9EjFwwa2w8
TLSH
T1AF360209E5EB01F4DCABC2FD8B825417D7B278454738D5EB0291AB561F9BEE08E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

640524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2050hb_D20261006T165337\fa_rss\x64\Release\Setup.pdb

advapi32

QueryServiceObjectSecurity ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW RegOpenKeyExW StartServiceW RegSetValueExW ControlService SetServiceObjectSecurity DeleteService RegCreateKeyExW ConvertSecurityDescriptorToStringSecurityDescriptorW ChangeServiceConfig2W OpenSCManagerW CloseServiceHandle RegCloseKey CreateServiceW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW RegEnumKeyExW RegDeleteValueW RegDeleteTreeW RegDeleteKeyExW GetTokenInformation LookupAccountSidW MapGenericMask ConvertSidToStringSidW DuplicateToken CheckTokenMembership FreeSid OpenProcessToken GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW AllocateAndInitializeSid AccessCheck GetSecurityInfo

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle

wininet

InternetCloseHandle InternetConnectW InternetReadFile HttpQueryInfoW InternetOpenW InternetOpenUrlW HttpOpenRequestW HttpSendRequestW

comctl32

InitCommonControlsEx ord412 ord410 ord413 PropertySheetW

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoTaskMemFree CoInitializeEx CoInitializeSecurity CoInitialize

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW RaiseException InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleFileNameW GetTempPathW GetLastError CloseHandle LocalFree CreateProcessW MultiByteToWideChar ExpandEnvironmentStringsA GetUserDefaultUILanguage LCIDToLocaleName OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId WideCharToMultiByte QueryFullProcessImageNameW GetCurrentThreadId CreateDirectoryW GetCommandLineW CreateMutexW OpenEventW Sleep SetEvent DeleteFileW ExitProcess GetTempFileNameW MoveFileW SizeofResource LockResource LoadResource FindResourceW ReadFile FindFirstFileExW FindNextFileW GetCurrentProcess WriteFile TerminateProcess RemoveDirectoryW CreateNamedPipeW InitializeProcThreadAttributeList HeapReAlloc WaitForSingleObject CreateFileW GetFileAttributesW DisconnectNamedPipe GetTickCount64 UpdateProcThreadAttribute DeleteProcThreadAttributeList WaitNamedPipeW ConnectNamedPipe FlushFileBuffers GetSystemFirmwareTable GetModuleHandleW MulDiv LoadLibraryW MoveFileExW GetFileAttributesExW SetFileAttributesW GetFileType GetTickCount GetFileSizeEx GetFileTime SetFilePointerEx EnumSystemLocalesW GetSystemTimeAsFileTime GetCPInfo CompareStringEx SleepConditionVariableSRW WakeAllConditionVariable QueryPerformanceCounter LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection TlsAlloc GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW GetLocaleInfoEx FormatMessageA CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetProcAddress DeviceIoControl AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileW TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile SetLastError InitializeCriticalSectionAndSpinCount FindClose

user32

EnableMenuItem OffsetRect RedrawWindow SetDlgItemTextW FrameRect GetWindowDC UpdateWindow EnableWindow GetKeyState InflateRect MonitorFromWindow GetSystemMetrics GetCapture DestroyIcon GetDlgCtrlID TrackMouseEvent IsWindowEnabled DrawIconEx PtInRect LoadImageW BeginPaint EndPaint GetWindowLongW PostMessageW GetWindowRect GetDC SetWindowPos UnregisterClassW FillRect CreateWindowExW SendMessageW KillTimer SetTimer MapWindowPoints LoadCursorW SetCursor SetWindowLongW GetClientRect GetDlgItem GetSysColorBrush GetParent InvalidateRect ReleaseDC GetWindowTextW GetWindowThreadProcessId GetShellWindow MessageBoxExW ShowWindow SetFocus SetForegroundWindow GetMessageW ScreenToClient CallNextHookEx WindowFromPoint IsWindow DispatchMessageW IsChild GetForegroundWindow UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostThreadMessageW GetCursorPos MonitorFromPoint GetMonitorInfoW EnumDisplaySettingsW DefWindowProcW DestroyWindow GetSystemMenu IsWindowVisible GetSysColor GetWindowLongPtrW RegisterClassW SetWindowTextW SetWindowLongPtrW DrawTextW

gdi32

DeleteDC CreatePen SetBkColor CreateSolidBrush RoundRect SelectObject CreateCompatibleDC GetDeviceCaps SetTextColor SetBkMode DeleteObject CreateFontIndirectW CreateDIBSection CreateCompatibleBitmap BitBlt GetObjectW GetNearestColor GetStockObject

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

shlwapi

PathFindFileNameW

iphlpapi

GetAdaptersInfo

uxtheme

SetWindowTheme

bcrypt

BCryptDestroyHash BCryptHashData BCryptDeriveKeyPBKDF2 BCryptCreateHash BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptGenRandom

ntdll

RtlCaptureContext RtlPcToFileHeader RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlUnwind

Name

.text

Size

872KB

Virtual Size

872KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_7e5860f678a55e4aa1e8b12442117855_blankgrabber_icedid_luca-stealer_njrat_stealc

advapi32

winhttp

wininet

comctl32

ole32

shell32

kernel32

user32

gdi32

oleaut32

shlwapi

iphlpapi

uxtheme

bcrypt

ntdll

generic