2026-11-12_4a1c159361cb6602ce6ccbe969112ffc_blankgrabber_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_4a1c159361cb6602ce6ccbe969112ffc_blankgrabber_icedid_luca-stealer_njrat_stealc
Size 4.8MB
Sample261113-ebmn8afy4m
SHA256 b78ce064ca2ff4a82bd2337f45205e92bc329c84d2ed7d16c141a7d4a75f4be0
MD5 4a1c159361cb6602ce6ccbe969112ffc
SHA1 02697bec7ec6ca5c4865ebb139b2f7964c814be6
SHA512 9455e57e8895921d0572b006ef4f6fb8f46e3ff68bf9d4358d049ac0fd854f06d74cda39d2e964f39b9d2af7c378f6404829f31caec5698c3c6b3bf39df6d260
SSDEEP 98304:ty3mbab2uajpbiHptCuzQCLIRe6xeuMxTKz2pMW6ZaxrruO1vd7:ty3mab2UftzQCcI6IZTYWxX1t
TLSH
T17A360209E6DB01F5CCA6C2BD8B825417DBB278454738D5EB02D1AB060FA7EE18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_4a1c159361cb6602ce6ccbe969112ffc_blankgrabber_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-12_4a1c159361cb6602ce6ccbe969112ffc_blankgrabber_icedid_luca-stealer_njrat_stealc

.exe 4.8MB

2026-11-12_4a1c159361cb6602ce6ccbe969112ffc_blankgrabber_icedid_luca-stealer_njrat_stealc

IMPHASH 5a4c3b7b397edc1ccb18ef73d8b6b70e
SHA256 b78ce064ca2ff4a82bd2337f45205e92bc329c84d2ed7d16c141a7d4a75f4be0
MD5 4a1c159361cb6602ce6ccbe969112ffc
SHA1 02697bec7ec6ca5c4865ebb139b2f7964c814be6
SHA512 9455e57e8895921d0572b006ef4f6fb8f46e3ff68bf9d4358d049ac0fd854f06d74cda39d2e964f39b9d2af7c378f6404829f31caec5698c3c6b3bf39df6d260
SSDEEP 98304:ty3mbab2uajpbiHptCuzQCLIRe6xeuMxTKz2pMW6ZaxrruO1vd7:ty3mab2UftzQCcI6IZTYWxX1t
TLSH
T17A360209E6DB01F5CCA6C2BD8B825417DBB278454738D5EB02D1AB060FA7EE18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

644220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2050ja_D20261105T152324\fa_rss\x64\Release\Setup.pdb

advapi32

QueryServiceObjectSecurity ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW RegOpenKeyExW StartServiceW RegSetValueExW ControlService SetServiceObjectSecurity DeleteService RegCreateKeyExW ConvertSecurityDescriptorToStringSecurityDescriptorW ChangeServiceConfig2W OpenSCManagerW CloseServiceHandle RegCloseKey CreateServiceW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW RegEnumKeyExW RegDeleteValueW RegDeleteTreeW RegDeleteKeyExW GetTokenInformation LookupAccountSidW MapGenericMask ConvertSidToStringSidW DuplicateToken CheckTokenMembership FreeSid OpenProcessToken GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW AllocateAndInitializeSid AccessCheck GetSecurityInfo

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpReadData WinHttpCloseHandle WinHttpQueryDataAvailable

wininet

InternetReadFile HttpQueryInfoW InternetOpenW InternetOpenUrlW HttpOpenRequestW InternetConnectW HttpSendRequestW InternetCloseHandle

comctl32

ord410 ord412 InitCommonControlsEx PropertySheetW ord413

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree CoInitializeEx CoInitialize

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW

kernel32

LCMapStringW CompareStringW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleFileNameW GetTempPathW GetLastError CloseHandle LocalFree CreateProcessW MultiByteToWideChar ExpandEnvironmentStringsA GetUserDefaultUILanguage LCIDToLocaleName OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId WideCharToMultiByte QueryFullProcessImageNameW GetCurrentThreadId CreateDirectoryW GetCommandLineW CreateMutexW OpenEventW Sleep SetEvent DeleteFileW ExitProcess GetTempFileNameW MoveFileW SizeofResource LockResource LoadResource FindResourceW ReadFile FindFirstFileExW FindNextFileW GetCurrentProcess WriteFile TerminateProcess RemoveDirectoryW CreateNamedPipeW InitializeProcThreadAttributeList FindClose IsValidLocale CreateFileW GetFileAttributesW DisconnectNamedPipe GetTickCount64 UpdateProcThreadAttribute DeleteProcThreadAttributeList WaitNamedPipeW ConnectNamedPipe FlushFileBuffers GetSystemFirmwareTable GetModuleHandleW MulDiv LoadLibraryW MoveFileExW GetFileAttributesExW SetFileAttributesW GetFileType GetTickCount GetFileSizeEx GetFileTime SetFilePointerEx GetSystemTimeAsFileTime GetCPInfo CompareStringEx SleepConditionVariableSRW WakeAllConditionVariable QueryPerformanceCounter LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW GetLocaleInfoEx FormatMessageA CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetProcAddress DeviceIoControl AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException VirtualProtect GetLocaleInfoW WaitForSingleObject

user32

EnableMenuItem OffsetRect RedrawWindow SetDlgItemTextW FrameRect GetWindowDC UpdateWindow EnableWindow GetKeyState InflateRect MonitorFromWindow GetSystemMetrics GetCapture DestroyIcon GetDlgCtrlID TrackMouseEvent IsWindowEnabled DrawIconEx PtInRect LoadImageW BeginPaint EndPaint GetWindowLongW PostMessageW GetWindowRect GetDC SetWindowPos RegisterClassW FillRect CreateWindowExW SendMessageW UnregisterClassW GetWindowLongPtrW KillTimer LoadCursorW SetCursor SetWindowLongW GetClientRect DrawTextW GetSysColorBrush GetParent InvalidateRect ReleaseDC GetWindowTextW GetWindowThreadProcessId GetShellWindow MessageBoxExW ShowWindow SetFocus SetForegroundWindow GetMessageW ScreenToClient CallNextHookEx WindowFromPoint IsWindow DispatchMessageW IsChild GetForegroundWindow UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostThreadMessageW GetCursorPos MonitorFromPoint GetMonitorInfoW EnumDisplaySettingsW DefWindowProcW SetTimer DestroyWindow GetSystemMenu IsWindowVisible GetSysColor MapWindowPoints SetWindowTextW SetWindowLongPtrW GetDlgItem

gdi32

SetBkColor CreateSolidBrush RoundRect SelectObject GetStockObject CreatePen SetTextColor SetBkMode DeleteObject CreateFontIndirectW DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt GetObjectW GetNearestColor CreateDIBSection GetDeviceCaps

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shlwapi

PathFindFileNameW

iphlpapi

GetAdaptersInfo

uxtheme

SetWindowTheme

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

crypt32

CertGetCertificateContextProperty CertGetNameStringW

bcrypt

BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenRandom BCryptGenerateSymmetricKey BCryptEncrypt BCryptFinishHash BCryptDestroyKey

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlUnwind RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind

Name

.text

Size

876KB

Virtual Size

876KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_4a1c159361cb6602ce6ccbe969112ffc_blankgrabber_icedid_luca-stealer_njrat_stealc

advapi32

winhttp

wininet

comctl32

ole32

shell32

kernel32

user32

gdi32

oleaut32

shlwapi

iphlpapi

uxtheme

wintrust

crypt32

bcrypt

ntdll

generic