2026-08-15_d8d10c661ff7becf2dcb786e12cc0f9a_gazer_helldown_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_d8d10c661ff7becf2dcb786e12cc0f9a_gazer_helldown_icedid
Size 3.9MB
Sample260815-fx4ejadh94
SHA256 295e34799b96bc0ad420048ee3d475980623884a12f9263d54ff3ba99c2d359e
MD5 d8d10c661ff7becf2dcb786e12cc0f9a
SHA1 3878c1a131c8c4475e6ecc92f96a39050889c323
SHA512 3004666d8deaf0ef28a2435264e2db69e2773a1b73c47d533c625349f83d094157630dd06ea2b503051e4d12c291cba96311c95daf5f2a1428602dbd1f92216b
SSDEEP 49152:gucyz60a7hZcWVYoqpt+J275U65aj+lL7QItFnxIyxlq8TxW18dCJ:7F60yR/qLJP3Ddc
TLSH
T124165B16B2A540D5D2A6C178CDA9D216E7713C2C4BF196FB31907BDD2E33AE03A39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-15_d8d10c661ff7becf2dcb786e12cc0f9a_gazer_helldown_icedid

.exe 3.9MB

2026-08-15_d8d10c661ff7becf2dcb786e12cc0f9a_gazer_helldown_icedid

IMPHASH 51524ba255e929dc3d5d9cab46c800f6
SHA256 295e34799b96bc0ad420048ee3d475980623884a12f9263d54ff3ba99c2d359e
MD5 d8d10c661ff7becf2dcb786e12cc0f9a
SHA1 3878c1a131c8c4475e6ecc92f96a39050889c323
SHA512 3004666d8deaf0ef28a2435264e2db69e2773a1b73c47d533c625349f83d094157630dd06ea2b503051e4d12c291cba96311c95daf5f2a1428602dbd1f92216b
SSDEEP 49152:gucyz60a7hZcWVYoqpt+J275U65aj+lL7QItFnxIyxlq8TxW18dCJ:7F60yR/qLJP3Ddc
TLSH
T124165B16B2A540D5D2A6C178CDA9D216E7713C2C4BF196FB31907BDD2E33AE03A39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

59:57:53:1f:c4:18:c7:43:18:08:57:4a:a5:e7:f3:b3:13:76:38:44:72:8c:ae:4b:fb:7d:d1:7e:ed:95:10:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=ul Narodnoy voli\, str 19a,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 12, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

5d:d8:ba:ec:a2:6f:86:7b:fc:b4:b8:ec

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2025 - Jun 20, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1325268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BuildAgent\work\7236625856f3c609\bin\Release_x64\session.server.pdb

kernel32

ExpandEnvironmentStringsW FileTimeToSystemTime LocalFree FreeLibrary OpenThread FormatMessageW GetComputerNameW SetThreadExecutionState GetModuleHandleW CreateProcessW GetExitCodeProcess WaitForMultipleObjects SetNamedPipeHandleState ConnectNamedPipe CreateNamedPipeW GetOverlappedResult DuplicateHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW DisconnectNamedPipe LocalAlloc EncodePointer DecodePointer GetStartupInfoW RaiseException RtlPcToFileHeader UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapSize RtlUnwindEx GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation GetVersion HeapCreate HeapDestroy ResetEvent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetStringTypeW HeapReAlloc GetLocaleInfoW GetConsoleCP GetConsoleMode GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleW FindNextFileW FindClose GetNativeSystemInfo CreateSemaphoreW WaitForSingleObjectEx FormatMessageA SetConsoleTextAttribute ReleaseSemaphore TryEnterCriticalSection TlsGetValue TlsSetValue TlsFree TlsAlloc SetThreadPriority SetEnvironmentVariableA CompareStringW CreateProcessA GetFileAttributesA ExitThread GlobalUnlock GlobalAlloc GlobalLock CreatePipe SetHandleInformation lstrcmpiW ReleaseMutex CreateMutexW SwitchToThread ResumeThread SuspendThread GetFileAttributesExW lstrcmpW GetSystemTimes SetLastError GetFileSizeEx SetEvent WaitForSingleObject lstrlenA GetTickCount ExitProcess GetSystemTime DeleteFileW CloseHandle GetCurrentThreadId GlobalMemoryStatusEx LockResource ProcessIdToSessionId CreateFileW GetModuleFileNameW GetFileAttributesW GetVersionExW SizeofResource GetProcessTimes GetSystemTimeAsFileTime GetCurrentProcess SetUnhandledExceptionFilter LoadResource FindResourceW FindResourceExW GetEnvironmentVariableW SetEnvironmentVariableW Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ReadFile CopyFileW WideCharToMultiByte WriteFile GetProcessHeap GetCommandLineW GetCurrentThread HeapFree SystemTimeToFileTime HeapAlloc SetFilePointer FindFirstFileW FreeResource MultiByteToWideChar CreateThread CreateEventW FlushFileBuffers GetLocalTime GetTimeZoneInformation GetCurrentProcessId RegisterWaitForSingleObject GetProcAddress GetLastError lstrlenW GetEnvironmentVariableA TerminateProcess LoadLibraryW OpenProcess GetQueuedCompletionStatus LoadLibraryA GetSystemDirectoryA FreeConsole CreateIoCompletionPort QueryPerformanceFrequency RemoveDirectoryW MoveFileW CreateDirectoryW GetLogicalDriveStringsW SetErrorMode SetFileTime SetFileAttributesW UnregisterWait QueryPerformanceCounter

user32

EmptyClipboard OpenClipboard SetClipboardData VkKeyScanExW MapVirtualKeyW GetKeyboardLayout ToUnicodeEx EnumDisplayMonitors IsClipboardFormatAvailable GetClipboardSequenceNumber GetKeyState GetAsyncKeyState CloseClipboard GetClipboardData SetThreadDesktop GetUserObjectInformationW UnregisterClassW EnumChildWindows GetClientRect DestroyIcon SetFocus InvalidateRect GetWindowTextW SetWindowLongW SetWindowTextW DialogBoxParamW GetWindowLongPtrW SetClassLongPtrW EndDialog CreateDialogParamW SetWindowLongPtrW OpenDesktopW EnumClipboardFormats GetThreadDesktop PostMessageW MessageBoxW GetCursorPos SetForegroundWindow MapWindowPoints MoveWindow LockWorkStation SetProcessWindowStation CloseWindowStation OpenWindowStationW DestroyWindow GetMessageW PostQuitMessage TranslateMessage IsDialogMessageW CreateWindowExW RegisterClassW DefWindowProcW DispatchMessageW CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx ExitWindowsEx LoadIconW GetSystemMenu SystemParametersInfoW EnableMenuItem SendMessageW GetWindowRect SetWindowPos FindWindowW ShowWindow wsprintfA SetTimer KillTimer wsprintfW GetDlgItem RegisterWindowMessageW GetWindow GetWindowThreadProcessId GetSystemMetrics GetWindowLongW GetForegroundWindow SendInput GetDC GetClassNameW FindWindowExW PeekMessageW WaitMessage GetWindowInfo CloseDesktop OpenInputDesktop IsWindowVisible EnumWindows GetCursorInfo GetIconInfo DrawIconEx ChangeDisplaySettingsExW EnumDisplayDevicesW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken

psapi

GetModuleFileNameExW

crypt32

CryptUnprotectData CryptProtectData

shlwapi

StrStrIW StrStrIA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winmm

timeBeginPeriod timeEndPeriod

secur32

GetUserNameExW

gdi32

GetCurrentObject GetDIBits GetBitmapBits ExtEscape CreateDCW SelectObject GetObjectW BitBlt DeleteDC CreateDIBSection DeleteObject CreateFontW CreateCompatibleDC

advapi32

CreateProcessAsUserW DuplicateToken SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertStringSidToSidW CopySid ImpersonateNamedPipeClient SetSecurityInfo SetTokenInformation ControlService ReportEventW DeregisterEventSource RegisterEventSourceW CryptGenRandom ChangeServiceConfigW QueryServiceStatusEx StartServiceW ChangeServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW RegDeleteKeyW RegEnumKeyW AdjustTokenPrivileges LookupPrivilegeValueW RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW DuplicateTokenEx RegOpenCurrentUser CryptDecrypt CryptDestroyKey CryptImportKey CryptReleaseContext CryptSetKeyParam CryptAcquireContextW RegSetValueExW CheckTokenMembership RegOpenKeyExW FreeSid AllocateAndInitializeSid RegDeleteValueW RegQueryValueExW EqualSid RegCreateKeyExW GetTokenInformation OpenThreadToken OpenProcessToken RegCloseKey RevertToSelf ImpersonateLoggedOnUser GetUserNameW

shell32

Shell_NotifyIconW SHGetFolderPathW CommandLineToArgvW ord680 SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW SHCreateDirectoryExW

ws2_32

inet_addr inet_ntoa gethostbyaddr WSASetLastError getservbyname sendto getservbyport socket send gethostname ntohl htonl htons ntohs gethostbyname getpeername WSAIoctl WSARecv WSASocketW WSASend ioctlsocket connect freeaddrinfo __WSAFDIsSet closesocket getsockopt listen accept recvfrom getaddrinfo select recv getsockname setsockopt WSAStartup WSACleanup shutdown WSAGetLastError WSASocketA WSAAddressToStringA WSAStringToAddressA bind

comctl32

InitCommonControlsEx

ole32

CoCreateInstance CoUninitialize CoInitialize CoCreateGuid

iphlpapi

GetAdaptersAddresses

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_d8d10c661ff7becf2dcb786e12cc0f9a_gazer_helldown_icedid

kernel32

user32

version

wtsapi32

psapi

crypt32

shlwapi

userenv

winmm

secur32

gdi32

advapi32

shell32

ws2_32

comctl32

ole32

iphlpapi

generic