2026-09-03_c897967be765fe786b29722c7f1a7190_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_c897967be765fe786b29722c7f1a7190_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc
Size 17.2MB
Sample260903-2spapsgn3w
SHA256 d23319190eae29b26e972e7d5dd8c87b2a53c089d6f85f73e42fefeebab04624
MD5 c897967be765fe786b29722c7f1a7190
SHA1 a1b910bc89c255d4f93ed81f5d381070bb4098eb
SHA512 e8b6128b69669a39ed9ef4226df9fe9c82bf92f6086c4a0cd1edd3b520a9f8441207f6beec0922e50b25f3a005c1e10be6556b8886012a8302bcb5feeb695d1e
SSDEEP 98304:Oyh8pbgBopN3jJa3Et2o6YF885YEkm0HsSEHg4pcqz2XL9PbfnAkp0DRwNswRUs:QpbP3Q3eYEkkei279z4vwMs
TLSH
T13E077D2A62D402ECD0BBC07D8F4A9A53EB72740D43716AFB05A445A51F67BE09F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-09-03_c897967be765fe786b29722c7f1a7190_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

File Explorer

2026-09-03_c897967be765fe786b29722c7f1a7190_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

.exe 17.2MB

2026-09-03_c897967be765fe786b29722c7f1a7190_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

IMPHASH 8845da779b47f84ecef1840356a25e3e
SHA256 d23319190eae29b26e972e7d5dd8c87b2a53c089d6f85f73e42fefeebab04624
MD5 c897967be765fe786b29722c7f1a7190
SHA1 a1b910bc89c255d4f93ed81f5d381070bb4098eb
SHA512 e8b6128b69669a39ed9ef4226df9fe9c82bf92f6086c4a0cd1edd3b520a9f8441207f6beec0922e50b25f3a005c1e10be6556b8886012a8302bcb5feeb695d1e
SSDEEP 98304:Oyh8pbgBopN3jJa3Et2o6YF885YEkm0HsSEHg4pcqz2XL9PbfnAkp0DRwNswRUs:QpbP3Q3eYEkkei279z4vwMs
TLSH
T13E077D2A62D402ECD0BBC07D8F4A9A53EB72740D43716AFB05A445A51F67BE09F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

8a:c7:90:a4:69:71:3c:b6:8b:c7:e3:d6:85:f1:ec:99:d8:a3:8a:4c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Aug 5, 2026

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0c:e9:54:4b:00:f2:74:34:81:46:32:56:9f:c6:c7:a2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 17, 2025 - Mar 25, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

13154912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup connect __WSAFDIsSet WSACloseEvent WSASetLastError select WSACreateEvent setsockopt ioctlsocket WSAStartup socket WSAGetLastError getaddrinfo freeaddrinfo send recv closesocket inet_pton WSAWaitForMultipleEvents WSAEventSelect WSAEnumNetworkEvents

dxgi

CreateDXGIFactory CreateDXGIFactory1 CreateDXGIFactory2

pdh

PdhAddCounterW PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptHashData BCryptGenRandom BCryptCreateHash

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext

kernel32

FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetCommandLineA ExitProcess GetConsoleOutputCP ReadConsoleW GetConsoleMode SetEnvironmentVariableW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType CreateProcessW DuplicateHandle FreeLibraryAndExitThread ExitThread GetExitCodeProcess IsValidCodePage GetACP GetCommandLineW GetOEMCP GlobalMemoryStatusEx GetSystemInfo GetDiskFreeSpaceExA GetLastError GetCurrentThread SetThreadPriority FreeLibrary LoadLibraryExA LoadLibraryA SetDllDirectoryA ReadFile CloseHandle CreatePipe WaitForSingleObject CreateProcessA GetTickCount GetProcAddress LoadLibraryExW SetDllDirectoryW MultiByteToWideChar RaiseException SetEvent ResetEvent CreateEventA FormatMessageA Sleep FindClose FindFirstFileW HeapReAlloc WideCharToMultiByte GetSystemTimeAsFileTime MoveFileExA VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableA CreateDirectoryA CreateDirectoryW DeleteFileW GetFileAttributesA GetFileAttributesW GetFileSizeEx GetFinalPathNameByHandleW RemoveDirectoryW SetFilePointerEx CreateFile2 IsDebuggerPresent DebugBreak OutputDebugStringW SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLogicalProcessorInformationEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW SetThreadGroupAffinity FormatMessageW GetCurrentProcessorNumber ReleaseSemaphore ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetSystemTimePreciseAsFileTime GetCurrentDirectoryW OutputDebugStringA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW RtlCaptureStackBackTrace VirtualAlloc VirtualFree GetLogicalProcessorInformation GetMaximumProcessorGroupCount GetMaximumProcessorCount GetStdHandle WriteFile CreateThread SetConsoleCtrlHandler TlsFree HeapSize RtlUnwind HeapQueryInformation SetStdHandle SetEndOfFile GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FindNextFileW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer LocalFree GetLocaleInfoEx TryAcquireSRWLockExclusive GetTickCount64 CreateFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx SwitchToThread GetExitCodeThread GetNativeSystemInfo WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection

user32

GetLastInputInfo

advapi32

RegQueryValueExW RegCloseKey EventWriteTransfer EventSetInformation EventRegister EventUnregister

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash PathCchRemoveFileSpec

dbghelp

SymFromAddr ImageDirectoryEntryToData

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiGetClassDevsA SetupDiEnumDeviceInfo

Name

.text

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

493KB

Virtual Size

636KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

415KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_c897967be765fe786b29722c7f1a7190_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

ws2_32

dxgi

pdh

bcrypt

crypt32

kernel32

user32

advapi32

winhttp

api-ms-win-core-path-l1-1-0

dbghelp

setupapi

generic