2026-09-16_17b5f4012095ed765b69cb69cc4a81f1_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_17b5f4012095ed765b69cb69cc4a81f1_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_ryuk_stealc
Size 62.1MB
Sample260916-3n2kxafe72
SHA256 1a6417a9dc9409a5bc34a4b3563fcc1afb99e159adbca2b52b0b81e951ddfd27
MD5 17b5f4012095ed765b69cb69cc4a81f1
SHA1 dfe6c28caf4b4c92ec6bca688b94dee1a5e0db84
SHA512 8523c56fe3d5fbb8acd835f7a7db15bdf9a3a646f72b87a0927c1327358b40cc823ffd9eb2346a09b760ca62e974aa1b5807132c441244acd4463c8bb7b65f48
SSDEEP 393216:+iSQsUw6pz9uRq/QahhdIUcq9gqS4SzWUw6pz9uRq/QahhdIUch9gqS4SzrUw6pe:61q984H1h984sF4Nw4
TLSH
T15DE77BD276E5D098C126D1B9CE02EAEFD66F7C298F2069DB36D0375F5A33990253A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_17b5f4012095ed765b69cb69cc4a81f1_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_ryuk_stealc

File Explorer

2026-09-16_17b5f4012095ed765b69cb69cc4a81f1_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_ryuk_stealc

.exe 62.1MB

2026-09-16_17b5f4012095ed765b69cb69cc4a81f1_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_ryuk_stealc

IMPHASH 10cb6420e2ad86adca6fde386fa06460
SHA256 1a6417a9dc9409a5bc34a4b3563fcc1afb99e159adbca2b52b0b81e951ddfd27
MD5 17b5f4012095ed765b69cb69cc4a81f1
SHA1 dfe6c28caf4b4c92ec6bca688b94dee1a5e0db84
SHA512 8523c56fe3d5fbb8acd835f7a7db15bdf9a3a646f72b87a0927c1327358b40cc823ffd9eb2346a09b760ca62e974aa1b5807132c441244acd4463c8bb7b65f48
SSDEEP 393216:+iSQsUw6pz9uRq/QahhdIUcq9gqS4SzWUw6pz9uRq/QahhdIUch9gqS4SzrUw6pe:61q984H1h984sF4Nw4
TLSH
T15DE77BD276E5D098C126D1B9CE02EAEFD66F7C298F2069DB36D0375F5A33990253A700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

d3d9

Direct3DCreate9

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageW EmptyClipboard EnumWindows GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId IsWindow IsWindowUnicode IsWindowVisible LoadCursorW MessageBoxW MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SendMessageTimeoutW SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowPos SetWindowRgn ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strrchr strstr wcsrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _close _fileno _fseeki64 _ftelli64 _get_osfhandle _setmode _wfopen _wopen fclose fflush fgetwc fopen fputc fputwc fread fseek ftell fwrite getc setbuf setvbuf ungetc ungetwc

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___wargv __p__wcmdln __sys_nerr _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler _wassert abort exit signal strerror strerror_s

api-ms-win-crt-environment-l1-1-0

__p__wenviron _putenv_s getenv

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _stricmp _strnicmp _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isdigit isspace isxdigit mbrlen memset strcat strcmp strcpy strlen strncmp strncpy strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoui64 atof mbrtowc mbsrtowcs strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l _time64

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acosf atan2f ceilf cosf fmodf log logf lroundf pow powf sinf sqrtf

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort rand_s

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CopyFileW CreateDirectoryA CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexW CreateProcessW CreateRemoteThread CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeLibrary GetActiveProcessorCount GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetProcAddress GetProcessId GetProcessTimes GetStartupInfoW GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadId GetTickCount64 GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile Module32First Module32FirstW Module32Next Module32NextW MoveFileExW MultiByteToWideChar OpenProcess OpenThread Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryA ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SuspendThread SwitchToThread TerminateThread Thread32First Thread32Next TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

532KB

Virtual Size

531KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ssc_evt

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

720B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59.4MB

Virtual Size

59.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_17b5f4012095ed765b69cb69cc4a81f1_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_ryuk_stealc

advapi32

bcrypt

d3d9

dwmapi

gdi32

ole32

user32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic