2026-08-20_f3447b4ba5e7bb6e0de1115c0f31ecd7_blankgrabber_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_f3447b4ba5e7bb6e0de1115c0f31ecd7_blankgrabber_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc
Size 24.2MB
Sample260820-22g8rabr21
SHA256 e0a5529c620729db6d664b3e273106660103d4726954d9851ef4a891b4f07522
MD5 f3447b4ba5e7bb6e0de1115c0f31ecd7
SHA1 3369f45cc93336826cbe96f9cdeb86534aaeffb0
SHA512 91216b677049e0cc2a26a6ca910696553a308abf748b43866067a54789bcf909e33e9df0a9acb93314a44b145ac5b0f4d5a307f34bec5e605ab0284f6ed6f3fb
SSDEEP 393216:1jSjFnO5AYgzY4yAgmcTMPVj+NWE/MRJHDdNiN/wV:SO5AVzY1IjHDGwV
TLSH
T1D747AE6A72B400E9E1BBC079C6569507EBB27856137097CF09A04AB61F3BBF05E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

File Explorer

2026-08-20_f3447b4ba5e7bb6e0de1115c0f31ecd7_blankgrabber_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc

.exe 24.2MB

2026-08-20_f3447b4ba5e7bb6e0de1115c0f31ecd7_blankgrabber_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc

IMPHASH 8f7d85d7c0d61ed6aca36dc475b63bf8
SHA256 e0a5529c620729db6d664b3e273106660103d4726954d9851ef4a891b4f07522
MD5 f3447b4ba5e7bb6e0de1115c0f31ecd7
SHA1 3369f45cc93336826cbe96f9cdeb86534aaeffb0
SHA512 91216b677049e0cc2a26a6ca910696553a308abf748b43866067a54789bcf909e33e9df0a9acb93314a44b145ac5b0f4d5a307f34bec5e605ab0284f6ed6f3fb
SSDEEP 393216:1jSjFnO5AYgzY4yAgmcTMPVj+NWE/MRJHDdNiN/wV:SO5AVzY1IjHDGwV
TLSH
T1D747AE6A72B400E9E1BBC079C6569507EBB27856137097CF09A04AB61F3BBF05E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist

Digest

b3:cf:cc:4e:7b:81:f1:98:26:78:5b:0c:d8:93:28:78:02:20:18:eb:85:8b:8a:0d:1e:da:70:99:a8:7b:88:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=803080949,CN=Juvio\, LLC,O=Juvio\, LLC,L=Kalamazoo,ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 18, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:ec:df:6e:d4:6c:c0:20:88:de:60:d8:13:83:9c:8a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 2, 2026 - Aug 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

15993292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\develop\source\Heroes of Newerth\bin_releasestatic\Juvio.pdb

kernel32

GetEnvironmentVariableA SleepEx GetLocalTime AddVectoredExceptionHandler GetVersion LockFileEx UnlockFileEx RemoveVectoredExceptionHandler GetQueuedCompletionStatusEx TransactNamedPipe GetFileTime GetVolumeInformationW GetWindowsDirectoryW InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent lstrcmpiW GetProcessHeap HeapAlloc GetFileAttributesExW GetFileAttributesW CreateFileW HeapFree GetFileSizeEx CompareFileTime ReadFile GetProcessTimes lstrcmpW QueryPerformanceCounter GetSystemTimeAsFileTime CreateThread QueryPerformanceFrequency lstrcatW ExpandEnvironmentStringsA CreateEventA GetLogicalProcessorInformation SetEvent CreateEventW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW lstrcpynW lstrlenW GetCurrentProcess EnterCriticalSection CreateSemaphoreW CloseHandle GetCurrentThreadId WaitForSingleObject ReleaseSemaphore FreeLibrary ExitProcess LocalFree GetProcAddress LoadLibraryW GetCommandLineA GetOEMCP IsValidCodePage HeapQueryInformation EnumSystemLocalesW IsValidLocale FlsFree FlsSetValue OutputDebugStringW GetLastError FormatMessageW OutputDebugStringA FlsGetValue FlsAlloc HeapSize SystemTimeToTzSpecificLocalTime SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread ExitThread InitializeCriticalSectionAndSpinCount RtlUnwind RtlUnwindEx Sleep InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetSystemDirectoryW GetDynamicTimeZoneInformation WideCharToMultiByte CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeleteFileW MultiByteToWideChar GetModuleHandleExW SetLastError ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA LoadLibraryA FormatMessageA GetStdHandle GetFileType WriteFile GetModuleHandleW GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetEnvironmentVariableW SwitchToFiber DeleteFiber CreateFiberEx GetACP DeleteCriticalSection GetExitCodeThread CreateSemaphoreA GetSystemTime SystemTimeToFileTime GetCurrentProcessId ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW GetCurrentDirectoryW SleepConditionVariableCS TryAcquireSRWLockExclusive WakeAllConditionVariable ResumeThread DuplicateHandle GetCurrentThread GetNativeSystemInfo GetStartupInfoW GlobalAlloc GlobalFree GlobalLock SetThreadExecutionState GlobalUnlock CompareStringW GetSystemDefaultLCID GetFullPathNameW GetLocaleInfoW GetUserDefaultLCID GetComputerNameW VerifyVersionInfoW SetFilePointer SetEndOfFile UnmapViewOfFile FlushViewOfFile GetFileSize CreateFileMappingW MapViewOfFile GetTimeZoneInformation LoadLibraryExW MulDiv SetEnvironmentVariableW GetConsoleTitleW GetTempPathW GetVersionExW FreeEnvironmentStringsW OpenProcess CreateToolhelp32Snapshot Process32NextW FileTimeToSystemTime Process32FirstW SetCurrentDirectoryW GlobalMemoryStatusEx GetEnvironmentStringsW DebugBreak SetErrorMode GetCPInfo GetModuleHandleA GetNumberFormatW GetCurrencyFormatW GetTimeFormatW GetDateFormatW SetHandleInformation SetFileCompletionNotificationModes CancelIo RegisterWaitForSingleObject UnregisterWait CancelIoEx SwitchToThread SetConsoleCtrlHandler GlobalSize CreateDirectoryW GetFileInformationByHandleEx GetDiskFreeSpaceW DeviceIoControl RemoveDirectoryW SetFileTime ReOpenFile CreateHardLinkW GetFileInformationByHandle SetFilePointerEx MoveFileExW CopyFileW CreateSymbolicLinkW FlushFileBuffers GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW SetNamedPipeHandleState CreateNamedPipeA CreateNamedPipeW PeekNamedPipe QueueUserWorkItem CancelSynchronousIo CreateFileA GetNamedPipeHandleStateW WaitNamedPipeW ConnectNamedPipe GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleCursorInfo SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW ResetEvent WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents SetConsoleCursorPosition SetInformationJobObject AssignProcessToJobObject TerminateProcess CreateJobObjectW UnregisterWaitEx LCMapStringW CreateProcessW GetExitCodeProcess InitializeCriticalSectionEx DecodePointer SetThreadPriority HeapReAlloc WaitForMultipleObjects SetDllDirectoryW GetThreadPriority GetTickCount RaiseException LocalAlloc K32EnumProcessModules GetCommandLineW GetVolumePathNameW SetFileAttributesW GetTickCount64 GetDriveTypeW SizeofResource LockResource LoadResource FindResourceW FindFirstFileExW GetFinalPathNameByHandleW GetDiskFreeSpaceExW CopyFileExW WaitForSingleObjectEx GetStringTypeW GetCurrentProcessorNumber GetLocaleInfoEx EncodePointer LCMapStringEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead

user32

IsZoomed GetClientRect SetWindowLongW SetCursor SetCapture ClipCursor LoadIconW RegisterRawInputDevices SetPropW BringWindowToTop SetFocus SetLayeredWindowAttributes FlashWindow GetMessageTime MoveWindow TrackMouseEvent GetRawInputData SetWindowPlacement MapWindowPoints GetLayeredWindowAttributes ClientToScreen CreateIconIndirect DestroyIcon SetTimer OffsetRect GetActiveWindow GetClassLongPtrW GetWindowPlacement WindowFromPoint MsgWaitForMultipleObjects WaitMessage SetWindowTextW GetSystemMetrics RemovePropW SendMessageW ScreenToClient MonitorFromWindow GetPropW SetRect GetWindowRect MapVirtualKeyW GetKeyState AdjustWindowRectEx GetWindowLongW IsWindow ToUnicodeEx GetKeyboardLayout GetKeyboardState GetDoubleClickTime GetWindowThreadProcessId MessageBeep GetSysColor UnregisterDeviceNotification ToUnicode RegisterDeviceNotificationW UnregisterClassW EnumDisplaySettingsW EnumDisplayDevicesW EnumDisplaySettingsExW ChangeDisplaySettingsExW DestroyCaret CreateCaret SetCaretPos RegisterWindowMessageW EndDeferWindowPos BeginDeferWindowPos DeferWindowPos GetDesktopWindow GetWindowTextW GetRawInputDeviceList GetRawInputDeviceInfoA GetClipboardSequenceNumber RegisterClipboardFormatW LoadImageW PostThreadMessageW GetQueueStatus MessageBoxW KillTimer SystemParametersInfoW PtInRect UpdateWindow GetCursorPos IsWindowVisible InvalidateRect IsIconic PeekMessageW GetMonitorInfoW DispatchMessageW GetMessageW ReleaseCapture ReleaseDC SetForegroundWindow PostQuitMessage CharUpperBuffW LoadCursorW TranslateMessage UpdateLayeredWindowIndirect MsgWaitForMultipleObjectsEx EnumDisplayMonitors AdjustWindowRect DefWindowProcW PostMessageW MonitorFromPoint DestroyWindow GetDC SetWindowPos CreateWindowExW RegisterClassExW ShowWindow GetProcessWindowStation GetUserObjectInformationW EnableWindow EndPaint BeginPaint SetCursorPos

gdi32

DeleteDC CreateCompatibleDC DescribePixelFormat DeleteObject BitBlt SetDeviceGammaRamp ChoosePixelFormat SelectObject SetPixelFormat SwapBuffers GdiFlush CreateRectRgn CreateBitmap GetDeviceCaps GetDeviceGammaRamp CreateDCW CreateDIBSection

shell32

SHGetKnownFolderPath ord730 SHCreateDirectoryExW ShellExecuteW SHGetFileInfoW CommandLineToArgvW ord74 DragQueryFileW SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW SHGetSpecialFolderPathW ShellExecuteExW ord727 ExtractIconW

ole32

OleUninitialize CoCreateGuid OleInitialize ReleaseStgMedium DoDragDrop OleSetClipboard RegisterDragDrop OleGetClipboard RevokeDragDrop CoInitialize CoTaskMemAlloc CoFreeUnusedLibraries CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance CoSetProxyBlanket CreateStreamOnHGlobal

wininet

HttpOpenRequestA InternetErrorDlg HttpQueryInfoW HttpQueryInfoA InternetCloseHandle HttpSendRequestA InternetConnectA InternetSetOptionW InternetQueryOptionW InternetOpenA InternetReadFile

imm32

ImmGetContext ImmIsIME ImmNotifyIME ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmReleaseContext

ws2_32

freeaddrinfo WSARecv WSASend WSASetLastError WSAConnect WSARecvFrom recv inet_ntop getaddrinfo inet_pton WSACleanup htons WSAStartup send ioctlsocket getsockopt ntohs gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname accept bind connect shutdown recvfrom sendto WSASendTo WSASocketW GetAddrInfoW FreeAddrInfoW closesocket gethostname WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents socket WSAGetLastError WSAIoctl WSASocketA WSAGetOverlappedResult getpeername getsockname listen setsockopt htonl select ntohl __WSAFDIsSet

d2d1

ord1

dwrite

DWriteCreateFactory

iphlpapi

NotifyIpInterfaceChange CancelMibChangeNotify2 if_indextoname GetUnicastIpAddressTable FreeMibTable if_nametoindex GetBestRoute2 GetAdaptersInfo GetAdaptersAddresses

crypt32

CertFreeCertificateContext CertGetIntendedKeyUsage CertOpenSystemStoreA CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertDuplicateCertificateContext CertCloseStore CertEnumCertificatesInStore CertOpenSystemStoreW CryptBinaryToStringW CertOpenStore CertFindCertificateInStore

userenv

GetUserProfileDirectoryW

shlwapi

PathIsRelativeW UrlCreateFromPathW PathCreateFromUrlW

winmm

timeGetTime timeEndPeriod timeKillEvent timeBeginPeriod timeSetEvent

oleacc

AccessibleObjectFromWindow LresultFromObject

comctl32

ImageList_DrawEx ImageList_Destroy ImageList_GetIconSize

ntdll

RtlLookupFunctionEntry NtReadFile NtQueryInformationFile RtlPcToFileHeader NtWriteFile NtOpenFile NtQueryDirectoryFile NtClose RtlCaptureStackBackTrace RtlFreeUnicodeString NtCreateFile RtlDosPathNameToNtPathName_U_WithStatus RtlAllocateHeap VerSetConditionMask RtlVirtualUnwind RtlCaptureContext NtSetInformationFile

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges GetSecurityDescriptorDacl RegCreateKeyExW ConvertStringSidToSidW RegDeleteTreeW RegSetValueExW ConvertSidToStringSidW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation SetSecurityInfo RegCloseKey SystemFunction036 OpenProcessToken RegOpenKeyExW RegQueryValueExW GetUserNameW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey RegGetValueW CryptAcquireContextW RegOpenKeyExA RegGetValueA DeregisterEventSource RegisterEventSourceW ReportEventW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegEnumKeyExA RegNotifyChangeKeyValue RegQueryValueExA

oleaut32

VariantInit VariantClear SafeArrayDestroy SafeArrayPutElement SafeArrayCreateVector SysFreeString SysAllocStringLen

secur32

InitSecurityInterfaceW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

dbghelp

SymInitialize SymFromAddr SymGetModuleInfo64 SymCleanup

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchAppend

Name

.text

Size

16.9MB

Virtual Size

16.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

436KB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

683KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=259, version=33145,

count=8, id=253, version=35207,

count=20, id=260, version=35207,

count=228, id=261, version=33145,

count=19, id=259, version=35207,

count=118, id=261, version=35207,

count=1, id=259, version=35228,

count=42, productName=Unmarked objects (old),

count=1432, id=260, version=35228,

count=725, id=261, version=35228,

count=85, id=260, version=33145,

count=1, id=262, version=33145,

count=51, id=257, version=33145,

count=692, id=1, productName=Unmarked objects,

count=510, id=265, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,