2026-07-22_21ce58751dc432ccad439ecc2915526d_gazer_helldown_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_21ce58751dc432ccad439ecc2915526d_gazer_helldown_icedid
Size 3.9MB
Sample260723-cd2j2svsg1
SHA256 d62c4afc88ac9b8ec755c500464c2565d0880987752f8a114bddc77b4b534ea4
MD5 21ce58751dc432ccad439ecc2915526d
SHA1 b7d34b3b99fe48b410a2f80e5ac459f198d93c07
SHA512 3359c389776c2d484664e9745d105201aedeb6e40dde84edec4af8104f388e93988f720ad778fc60f527ee3ab636714028dcdc565ca1d8ccdf584c1550137a7b
SSDEEP 49152:vucyz60a7hZcWVYoqpt+J275U65aj+lL7QItFnxIyxGq8TB518dSH:mF60yR/qLJP3DdQ
TLSH
T1DC165B16B2A540D5D2A6C178CDA9D216E7713C2C4BF196FB31907BDD2E33AE03A39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-22_21ce58751dc432ccad439ecc2915526d_gazer_helldown_icedid

.exe 3.9MB

2026-07-22_21ce58751dc432ccad439ecc2915526d_gazer_helldown_icedid

IMPHASH 51524ba255e929dc3d5d9cab46c800f6
SHA256 d62c4afc88ac9b8ec755c500464c2565d0880987752f8a114bddc77b4b534ea4
MD5 21ce58751dc432ccad439ecc2915526d
SHA1 b7d34b3b99fe48b410a2f80e5ac459f198d93c07
SHA512 3359c389776c2d484664e9745d105201aedeb6e40dde84edec4af8104f388e93988f720ad778fc60f527ee3ab636714028dcdc565ca1d8ccdf584c1550137a7b
SSDEEP 49152:vucyz60a7hZcWVYoqpt+J275U65aj+lL7QItFnxIyxGq8TB518dSH:mF60yR/qLJP3DdQ
TLSH
T1DC165B16B2A540D5D2A6C178CDA9D216E7713C2C4BF196FB31907BDD2E33AE03A39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

c1:28:80:c7:88:88:34:47:fe:7a:05:da:e2:47:01:e6:32:0b:77:cb:86:23:a0:5b:1a:e5:0e:5d:87:af:d6:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=ul Narodnoy voli\, str 19a,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 22, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

5d:d8:ba:ec:a2:6f:86:7b:fc:b4:b8:ec

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2025 - Jun 20, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1325268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BuildAgent\work\7236625856f3c609\bin\Release_x64\session.server.pdb

kernel32

ExpandEnvironmentStringsW FileTimeToSystemTime LocalFree FreeLibrary OpenThread FormatMessageW GetComputerNameW SetThreadExecutionState GetModuleHandleW CreateProcessW GetExitCodeProcess WaitForMultipleObjects SetNamedPipeHandleState ConnectNamedPipe CreateNamedPipeW GetOverlappedResult DuplicateHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW DisconnectNamedPipe LocalAlloc EncodePointer DecodePointer GetStartupInfoW RaiseException RtlPcToFileHeader UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapSize RtlUnwindEx GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation GetVersion HeapCreate HeapDestroy ResetEvent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetStringTypeW HeapReAlloc GetLocaleInfoW GetConsoleCP GetConsoleMode GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleW FindNextFileW FindClose GetNativeSystemInfo CreateSemaphoreW WaitForSingleObjectEx FormatMessageA SetConsoleTextAttribute ReleaseSemaphore TryEnterCriticalSection TlsGetValue TlsSetValue TlsFree TlsAlloc SetThreadPriority SetEnvironmentVariableA CompareStringW CreateProcessA GetFileAttributesA ExitThread GlobalUnlock GlobalAlloc GlobalLock CreatePipe SetHandleInformation lstrcmpiW ReleaseMutex CreateMutexW SwitchToThread ResumeThread SuspendThread GetFileAttributesExW lstrcmpW GetSystemTimes SetLastError GetFileSizeEx SetEvent WaitForSingleObject lstrlenA GetTickCount ExitProcess GetSystemTime DeleteFileW CloseHandle GetCurrentThreadId GlobalMemoryStatusEx LockResource ProcessIdToSessionId CreateFileW GetModuleFileNameW GetFileAttributesW GetVersionExW SizeofResource GetProcessTimes GetSystemTimeAsFileTime GetCurrentProcess SetUnhandledExceptionFilter LoadResource FindResourceW FindResourceExW GetEnvironmentVariableW SetEnvironmentVariableW Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ReadFile CopyFileW WideCharToMultiByte WriteFile GetProcessHeap GetCommandLineW GetCurrentThread HeapFree SystemTimeToFileTime HeapAlloc SetFilePointer FindFirstFileW FreeResource MultiByteToWideChar CreateThread CreateEventW FlushFileBuffers GetLocalTime GetTimeZoneInformation GetCurrentProcessId RegisterWaitForSingleObject GetProcAddress GetLastError lstrlenW GetEnvironmentVariableA TerminateProcess LoadLibraryW OpenProcess GetQueuedCompletionStatus LoadLibraryA GetSystemDirectoryA FreeConsole CreateIoCompletionPort QueryPerformanceFrequency RemoveDirectoryW MoveFileW CreateDirectoryW GetLogicalDriveStringsW SetErrorMode SetFileTime SetFileAttributesW UnregisterWait QueryPerformanceCounter

user32

EmptyClipboard OpenClipboard SetClipboardData VkKeyScanExW MapVirtualKeyW GetKeyboardLayout ToUnicodeEx EnumDisplayMonitors IsClipboardFormatAvailable GetClipboardSequenceNumber GetKeyState GetAsyncKeyState CloseClipboard GetClipboardData SetThreadDesktop GetUserObjectInformationW UnregisterClassW EnumChildWindows GetClientRect DestroyIcon SetFocus InvalidateRect GetWindowTextW SetWindowLongW SetWindowTextW DialogBoxParamW GetWindowLongPtrW SetClassLongPtrW EndDialog CreateDialogParamW SetWindowLongPtrW OpenDesktopW EnumClipboardFormats GetThreadDesktop PostMessageW MessageBoxW GetCursorPos SetForegroundWindow MapWindowPoints MoveWindow LockWorkStation SetProcessWindowStation CloseWindowStation OpenWindowStationW DestroyWindow GetMessageW PostQuitMessage TranslateMessage IsDialogMessageW CreateWindowExW RegisterClassW DefWindowProcW DispatchMessageW CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx ExitWindowsEx LoadIconW GetSystemMenu SystemParametersInfoW EnableMenuItem SendMessageW GetWindowRect SetWindowPos FindWindowW ShowWindow wsprintfA SetTimer KillTimer wsprintfW GetDlgItem RegisterWindowMessageW GetWindow GetWindowThreadProcessId GetSystemMetrics GetWindowLongW GetForegroundWindow SendInput GetDC GetClassNameW FindWindowExW PeekMessageW WaitMessage GetWindowInfo CloseDesktop OpenInputDesktop IsWindowVisible EnumWindows GetCursorInfo GetIconInfo DrawIconEx ChangeDisplaySettingsExW EnumDisplayDevicesW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken

psapi

GetModuleFileNameExW

crypt32

CryptUnprotectData CryptProtectData

shlwapi

StrStrIW StrStrIA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winmm

timeBeginPeriod timeEndPeriod

secur32

GetUserNameExW

gdi32

GetCurrentObject GetDIBits GetBitmapBits ExtEscape CreateDCW SelectObject GetObjectW BitBlt DeleteDC CreateDIBSection DeleteObject CreateFontW CreateCompatibleDC

advapi32

CreateProcessAsUserW DuplicateToken SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertStringSidToSidW CopySid ImpersonateNamedPipeClient SetSecurityInfo SetTokenInformation ControlService ReportEventW DeregisterEventSource RegisterEventSourceW CryptGenRandom ChangeServiceConfigW QueryServiceStatusEx StartServiceW ChangeServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW RegDeleteKeyW RegEnumKeyW AdjustTokenPrivileges LookupPrivilegeValueW RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW DuplicateTokenEx RegOpenCurrentUser CryptDecrypt CryptDestroyKey CryptImportKey CryptReleaseContext CryptSetKeyParam CryptAcquireContextW RegSetValueExW CheckTokenMembership RegOpenKeyExW FreeSid AllocateAndInitializeSid RegDeleteValueW RegQueryValueExW EqualSid RegCreateKeyExW GetTokenInformation OpenThreadToken OpenProcessToken RegCloseKey RevertToSelf ImpersonateLoggedOnUser GetUserNameW

shell32

Shell_NotifyIconW SHGetFolderPathW CommandLineToArgvW ord680 SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW SHCreateDirectoryExW

ws2_32

inet_addr inet_ntoa gethostbyaddr WSASetLastError getservbyname sendto getservbyport socket send gethostname ntohl htonl htons ntohs gethostbyname getpeername WSAIoctl WSARecv WSASocketW WSASend ioctlsocket connect freeaddrinfo __WSAFDIsSet closesocket getsockopt listen accept recvfrom getaddrinfo select recv getsockname setsockopt WSAStartup WSACleanup shutdown WSAGetLastError WSASocketA WSAAddressToStringA WSAStringToAddressA bind

comctl32

InitCommonControlsEx

ole32

CoCreateInstance CoUninitialize CoInitialize CoCreateGuid

iphlpapi

GetAdaptersAddresses

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_21ce58751dc432ccad439ecc2915526d_gazer_helldown_icedid

kernel32

user32

version

wtsapi32

psapi

crypt32

shlwapi

userenv

winmm

secur32

gdi32

advapi32

shell32

ws2_32

comctl32

ole32

iphlpapi

generic