2026-08-15_298da8599e5b26e1d817909420fe2717_blankgrabber_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_298da8599e5b26e1d817909420fe2717_blankgrabber_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc
Size 15.7MB
Sample260815-ev3jsayeng
SHA256 d3179fd4c030070da68c821f7528dbf8a8a6d20fee7b579a0f3c3c5fc3156420
MD5 298da8599e5b26e1d817909420fe2717
SHA1 e283516bff5269d40c684ea9f3779dda05d2b649
SHA512 3f923c3a61f34ed28e37cf3157061332d3ecaa92699acdb909077d00090d676c3581186aeeb31032eaff723735a515efc203341aed32d46d2890602707bfd5bf
SSDEEP 393216:ORINxQUjwiytujIkBoZQRpKZ6JwvGOPAmktQ9L1:P4HuOQyL
TLSH
T1E4F69E5BE7B900E5C5BAC038D5426227FA717869433453DB6B985B9B1F63BE09E3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_298da8599e5b26e1d817909420fe2717_blankgrabber_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

File Explorer

2026-08-15_298da8599e5b26e1d817909420fe2717_blankgrabber_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

.exe 15.7MB

2026-08-15_298da8599e5b26e1d817909420fe2717_blankgrabber_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

IMPHASH 5df4797b83bfca28509b0978f8ea51be
SHA256 d3179fd4c030070da68c821f7528dbf8a8a6d20fee7b579a0f3c3c5fc3156420
MD5 298da8599e5b26e1d817909420fe2717
SHA1 e283516bff5269d40c684ea9f3779dda05d2b649
SHA512 3f923c3a61f34ed28e37cf3157061332d3ecaa92699acdb909077d00090d676c3581186aeeb31032eaff723735a515efc203341aed32d46d2890602707bfd5bf
SSDEEP 393216:ORINxQUjwiytujIkBoZQRpKZ6JwvGOPAmktQ9L1:P4HuOQyL
TLSH
T1E4F69E5BE7B900E5C5BAC038D5426227FA717869433453DB6B985B9B1F63BE09E3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9065364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\HOME\Documents\PersonalStuffPleaseDontTouch\1\2\ProjectCarbon\build\Project Carbon.pdb

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl WinHttpSetOption WinHttpAddRequestHeaders WinHttpQueryDataAvailable

ws2_32

htons htonl recvfrom accept WSAWaitForMultipleEvents WSAEventSelect inet_ntoa WSACreateEvent WSACloseEvent WSASetLastError select __WSAFDIsSet gethostname inet_addr gethostbyaddr WSAEnumNetworkEvents WSAResetEvent WSASocketA WSAIoctl sendto getservbyname gethostbyname WSAGetLastError setsockopt getservbyport getnameinfo ioctlsocket freeaddrinfo WSAPoll getsockopt recv bind listen WSAAccept WSACleanup closesocket shutdown WSASocketW inet_pton getaddrinfo WSAStartup getpeername getsockname send socket ntohs connect

crypt32

CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CertFreeCRLContext CertFreeCertificateContext CertOpenSystemStoreW CertEnumCertificatesInStore

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx VerSetConditionMask RtlVirtualUnwind RtlUnwind RtlPcToFileHeader

kernel32

GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleFileNameA GetLastError FormatMessageA WriteProcessMemory Module32Next WaitForSingleObject Module32First CreateToolhelp32Snapshot Sleep CloseHandle VirtualAllocEx CreateRemoteThread VirtualFreeEx VirtualQueryEx GetTickCount64 GetTickCount K32GetModuleBaseNameA GetSystemInfo VirtualProtectEx ReadProcessMemory FlushInstructionCache K32EnumProcessModules CreateFileA GetVolumeInformationA GetLocalTime AddVectoredExceptionHandler SwitchToThread GetConsoleWindow FillConsoleOutputCharacterA SizeofResource SetConsoleCtrlHandler GetFileSizeEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetStdHandle GetModuleHandleExW TerminateProcess GetModuleFileNameW GetCurrentThreadId CreateFile2 UnmapViewOfFile OpenProcess Process32NextW LockResource Process32FirstW GetConsoleTitleA FreeConsole LoadResource FindResourceW Module32FirstW FillConsoleOutputAttribute CreateFileMappingFromApp Module32NextW QueryFullProcessImageNameW SetConsoleOutputCP MapViewOfFileFromApp SetConsoleCursorPosition AllocConsole GetExitCodeProcess GetProcessId lstrcmpiW SetThreadPriority GetCurrentThread WriteFile SetUnhandledExceptionFilter ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile CreateFileMappingA RaiseException SetEvent ResetEvent CreateEventA GetSystemTimeAsFileTime MoveFileExA FindClose FreeLibrary FindNextFileW SetLastError GetFileType GetModuleHandleW GetSystemDirectoryA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc GlobalAlloc TlsSetValue TlsFree GetCurrentProcessId GetEnvironmentVariableW VirtualProtect VirtualFree GetACP InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime SystemTimeToFileTime LoadLibraryW ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionEx SleepEx WaitForSingleObjectEx CreateThread CreateFileW GetFullPathNameW MoveFileExW GetEnvironmentVariableA PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW LocalFree GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx WakeAllConditionVariable WakeConditionVariable GetCurrentProcess GetFinalPathNameByHandleW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryExW ExitProcess DuplicateHandle CreateProcessW ExitThread FreeLibraryAndExitThread GetConsoleOutputCP SetFilePointerEx GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers TlsGetValue QueryPerformanceCounter GetFileInformationByHandleEx InitializeSListHead CreatePipe DeleteFileW GetTimeZoneInformation SetEndOfFile IsValidCodePage GetOEMCP TryAcquireSRWLockExclusive SleepConditionVariableSRW GetStartupInfoW IsDebuggerPresent UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW SetEnvironmentVariableW HeapSize FindFirstFileW WriteConsoleW GetCPInfo CompareStringEx DecodePointer EncodePointer LCMapStringEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent InitOnceBeginInitialize InitOnceComplete GetNativeSystemInfo GetFileInformationByHandle

user32

SetLayeredWindowAttributes SetWindowLongA MonitorFromPoint PostMessageW GetProcessWindowStation IsWindow SetWindowDisplayAffinity DispatchMessageA GetWindowRect DestroyWindow SetWindowPos SetActiveWindow DefWindowProcA CreateWindowExA SetFocus TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetWindowThreadProcessId GetSystemMenu keybd_event DeleteMenu GetSystemMetrics MessageBoxA GetUserObjectInformationW SetForegroundWindow IsWindowVisible ShowWindow FindWindowA VkKeyScanA MapVirtualKeyA SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos GetAsyncKeyState MessageBoxW EnumWindows

gdi32

GetDeviceGammaRamp SetDeviceGammaRamp GetDeviceCaps

shell32

ShellExecuteW SHGetFolderPathA ShellExecuteA

ole32

CoInitializeEx CoCreateInstance

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winmm

timeBeginPeriod PlaySoundA

bcrypt

BCryptGenRandom

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

advapi32

CryptGetUserKey CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource

Name

.text

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.7MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

447KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=226, id=261, version=33145,

count=32, id=259, version=33145,

count=1, id=253, version=35207,

count=20, id=260, version=35207,

count=14, id=259, version=35207,

count=114, id=261, version=35207,

count=27, id=260, version=34123,

count=62, id=260, version=33145,

count=43, productName=Unmarked objects (old),

count=1136, id=260, version=35226,

count=26, id=261, version=35226,

count=4, id=259, version=35217,

count=31, id=260, version=35217,

count=27, id=260, version=32822,

count=37, id=257, version=33145,

count=450, id=1, productName=Unmarked objects,

count=172, id=265, version=35226,

count=1, id=259, version=35226,

count=1, id=256, version=35226,

count=1, id=255, version=35226,

count=1, id=151,

count=1, id=258, version=35226,