2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc
Size 3.9MB
Sample260708-fdpr2aa13y
SHA256 47f5faf151663a95c02607099be536e178744db56264e139e36856cd861e5aa1
MD5 3dbf435b704383c5b687ff1e423c0c4b
SHA1 22e0e3db24314e3e512117249fb0260993ab4f93
SHA512 dd1287bf2934a0d01f15f62a23ead49b6344625daea4b31f1a9552ffdb4fd457cc5082e7c7dcc732c7a2418206ac6ffa3e5c3fff44828cb3091008879df43ae7
SSDEEP 98304:uBmD33+PnVs9q8SdeF0e5SMekVMJ+7yisVCwksakV:Qm73A8Ss5SMekVMJ+7yi8Cv1kV
TLSH
T189169D27A3E801EAC0B7C1B8CA578723E772B4591375A7DF16E086562F236E15E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

.exe 3.9MB

2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

IMPHASH be981b0b01b3d6438e6eeae9da1bf67a
SHA256 47f5faf151663a95c02607099be536e178744db56264e139e36856cd861e5aa1
MD5 3dbf435b704383c5b687ff1e423c0c4b
SHA1 22e0e3db24314e3e512117249fb0260993ab4f93
SHA512 dd1287bf2934a0d01f15f62a23ead49b6344625daea4b31f1a9552ffdb4fd457cc5082e7c7dcc732c7a2418206ac6ffa3e5c3fff44828cb3091008879df43ae7
SSDEEP 98304:uBmD33+PnVs9q8SdeF0e5SMekVMJ+7yisVCwksakV:Qm73A8Ss5SMekVMJ+7yi8Cv1kV
TLSH
T189169D27A3E801EAC0B7C1B8CA578723E772B4591375A7DF16E086562F236E15E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

db:1c:1f:00:45:59:ea:bb:aa:6e:37:01:67:87:7a:9b:e3:d5:94:06:f9:0f:9d:8d:61:3a:23:c0:eb:09:c6:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=CYBERMID LIMITED,O=CYBERMID LIMITED,L=New York,ST=New York,C=US

Chains

Jun 24, 2026

CN=CYBERMID LIMITED,O=CYBERMID LIMITED,L=New York,ST=New York,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=CYBERMID LIMITED,O=CYBERMID LIMITED,L=New York,ST=New York,C=US

Serial Number

33:00:02:45:02:4c:95:91:be:fe:95:83:f9:00:00:00:02:45:02

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2026 - Jun 26, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

2518760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

connect closesocket getsockname htonl ntohs socket WSAGetLastError __WSAFDIsSet select WSASetLastError recv send WSAStartup inet_ntoa WSACleanup bind setsockopt accept getsockopt recvfrom listen

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CryptStringToBinaryW CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CertFindCertificateInStore

bcrypt

BCryptGenRandom

advapi32

CryptCreateHash RegDeleteKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegDeleteTreeW SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData RegDeleteKeyW CryptGetHashParam

secur32

InitSecurityInterfaceW

ws2_32

WSACreateEvent WSACloseEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents inet_pton getaddrinfo freeaddrinfo htons getpeername WSAIoctl WSAResetEvent gethostname sendto

iphlpapi

if_nametoindex

shell32

ShellExecuteW Shell_NotifyIconW SHGetKnownFolderPath SHChangeNotify

user32

GetMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW DestroyWindow SetTimer KillTimer RegisterWindowMessageW MessageBoxW TranslateMessage DispatchMessageW GetSystemMetrics InvalidateRect PeekMessageW CharLowerBuffW AppendMenuW CreatePopupMenu GetMonitorInfoW MonitorFromPoint LoadCursorW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient SetCursor RedrawWindow ValidateRect SetFocus SetWindowPos TrackMouseEvent GetWindowThreadProcessId GetClassNameW EnumWindows GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW IsWindowVisible LoadImageW DestroyIcon LoadIconW GetCursorPos SetForegroundWindow TrackPopupMenu DestroyMenu ShowWindow

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

dbghelp

MiniDumpWriteDump

d2d1

ord1

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice

d3d11

D3D11CreateDevice

kernel32

FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetCommandLineA ExitProcess SetFilePointerEx GetConsoleOutputCP ReadConsoleW FlsAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetStdHandle GetTimeZoneInformation RtlUnwindEx GetStartupInfoW InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer IsProcessorFeaturePresent CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns WakeAllConditionVariable WakeConditionVariable GetExitCodeThread InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI GetTempPathW GetLocaleInfoW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetEndOfFile IsValidCodePage DebugBreak CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcessId GetCurrentThreadId FreeLibrary GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW FormatMessageW WideCharToMultiByte MultiByteToWideChar IsDebuggerPresent OutputDebugStringW SetLastError ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW CreateFileW SetUnhandledExceptionFilter SetErrorMode GetCurrentProcess CreateMutexW LocalFree FlushFileBuffers WriteFile MoveFileExW WaitForMultipleObjects TerminateProcess CreateProcessW OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW RtlUnwind DuplicateHandle CreateEventW DeleteFileW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW GetCommandLineW SetEvent OpenEventW GetDiskFreeSpaceExW GetVolumeInformationW ReadProcessMemory GetFinalPathNameByHandleW QueryPerformanceCounter QueryPerformanceFrequency MulDiv FindClose FindFirstFileW FindNextFileW CopyFileW Sleep GetStdHandle GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo RaiseException ResetEvent CreateEventA FormatMessageA GetSystemTimeAsFileTime MoveFileExA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFullPathNameW SleepEx InitializeCriticalSectionEx DeleteCriticalSection GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW GetFileType ReadFile PeekNamedPipe CreateThread GetFileSizeEx GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize SetFileInformationByHandle Process32NextW

ole32

CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance PropVariantClear CoTaskMemAlloc CreateStreamOnHGlobal

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

wsock32

crypt32

bcrypt

advapi32

secur32

ws2_32

iphlpapi

shell32

user32

rpcrt4

dbghelp

d2d1

dwrite

dcomp

d3d11

kernel32

ole32

generic