2026-11-07_6217489df16d91a94d8806bd05c8136d_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_6217489df16d91a94d8806bd05c8136d_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 26.9MB
Sample261107-qxcxpact4v
SHA256 e71a35d64a931f4e88eb9981b4145fa24b6aea3a7d058aa8ee7397f5f3d5843b
MD5 6217489df16d91a94d8806bd05c8136d
SHA1 d548bd7cc9a9b84d2c1497680cc052a7f6f71163
SHA512 291d70141a5835c5b1a465ce2e178dab544cd07e920fb711229361d94990875a9669e262434dffe8e5633927bf3119aba40bb42271aec0dc7e942e3a7548b209
SSDEEP 393216:LKHGueGKIDpj7X8NK+IUdnQ+7FhULsZEmp0JfE7pgqbamcIpmpyDm0/lsreIA:LjuFUEQZEmp772qbambEEDm0NsrQ
TLSH
T12957331A76A101A8D0B7D278CE42551BD7B2744543B05EEF1AD08BA66F33AF04E3EF46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-07_6217489df16d91a94d8806bd05c8136d_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 26.9MB

2026-11-07_6217489df16d91a94d8806bd05c8136d_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH 4ba1de064a86b421337d09b7e4f6e2cc
SHA256 e71a35d64a931f4e88eb9981b4145fa24b6aea3a7d058aa8ee7397f5f3d5843b
MD5 6217489df16d91a94d8806bd05c8136d
SHA1 d548bd7cc9a9b84d2c1497680cc052a7f6f71163
SHA512 291d70141a5835c5b1a465ce2e178dab544cd07e920fb711229361d94990875a9669e262434dffe8e5633927bf3119aba40bb42271aec0dc7e942e3a7548b209
SSDEEP 393216:LKHGueGKIDpj7X8NK+IUdnQ+7FhULsZEmp0JfE7pgqbamcIpmpyDm0/lsreIA:LjuFUEQZEmp772qbambEEDm0NsrQ
TLSH
T12957331A76A101A8D0B7D278CE42551BD7B2744543B05EEF1AD08BA66F33AF04E3EF46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

6e:ef:34:d9:e1:0e:ee:26:84:39:23:f2:03:28:b8:42:fb:ac:e0:dc:b8:9a:a7:cd:fd:9b:5f:f9:4c:41:d2:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Dell Technologies Inc.,OU=GSCS Design,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

Chains

Sep 1, 2026

CN=Dell Technologies Inc.,OU=GSCS Design,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dell Technologies Inc.,OU=GSCS Design,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Dell Technologies Inc.,OU=GSCS Design,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US

Serial Number

04:6d:2b:0e:06:1f:e4:16:18:6f:3d:0e:c5:db:05:ce

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 1, 2026 - Apr 30, 2027

Minor OS version

Major OS version

Entry point

878116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile WaitForSingleObject Sleep GetLastError CreateFileA CloseHandle GetOverlappedResult WideCharToMultiByte CreateEventA HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap CreateDirectoryA OutputDebugStringA lstrlenA GetModuleFileNameA SetDefaultDllDirectories AddDllDirectory GetCurrentProcess GetModuleFileNameW CreateMutexA GetModuleHandleA GetSystemDirectoryA SetDllDirectoryA QueryPerformanceFrequency GetSystemWow64DirectoryA GetProcAddress QueryPerformanceCounter IsWow64Process GetUserDefaultUILanguage GetEnvironmentVariableA SizeofResource DeviceIoControl GetFirmwareEnvironmentVariableA CreateFileW GetCurrentThreadId ReleaseMutex OpenMutexA LockResource SetFirmwareEnvironmentVariableA FindResourceExW LoadResource FindResourceW GetLocalTime GetSystemPowerStatus GetVersionExA TerminateProcess CreateProcessA GetExitCodeProcess FindFirstFileA FindNextFileA FindClose DeleteFileA RemoveDirectoryA MultiByteToWideChar GetFileAttributesA GetFullPathNameA CancelIo LoadLibraryExA GetCurrentProcessId OpenProcess K32GetModuleFileNameExW K32GetProcessImageFileNameW LoadLibraryA RaiseException GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW SetEvent WaitForMultipleObjects CreateThread GetSystemFirmwareTable LocalFree FormatMessageA GetTickCount64 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive GetStringTypeW EncodePointer EnterCriticalSection LeaveCriticalSection LCMapStringEx GetCPInfo OutputDebugStringW FreeLibrary RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW DeleteFileW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx GetCurrentDirectoryW GetFullPathNameW SetStdHandle ReadConsoleW CreateDirectoryW FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlushFileBuffers GetTimeZoneInformation SetEndOfFile WriteConsoleW ResetEvent CreateEventW ReadFile RtlUnwind

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=202, id=261, version=33145,

count=10, id=259, version=33145,

count=5, id=257, version=33145,

count=1, id=253, version=35207,

count=10, id=259, version=35207,

count=19, id=260, version=35207,

count=21, id=260, version=33145,

count=87, id=261, version=35211,

count=109, id=261, version=35207,

count=309, id=1, productName=Unmarked objects,

count=1, id=261, version=27048,

count=6, id=261, version=35213,

count=8, id=260, version=30148,

count=7, id=261, version=35221,

count=3, id=260, version=35214,

count=29, id=261, version=35214,

count=13, id=261, version=34809,

count=28, id=265, version=35226,

count=1, id=255, version=35226,

count=1, id=151,

count=1, id=258, version=35226,