2026-10-31_ec03fd024b61be4ddb7c4d21fb14a6af_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_ec03fd024b61be4ddb7c4d21fb14a6af_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc
Size 18.0MB
Sample261101-xekcdada73
SHA256 e7037002bea04f7f34e7106cc529f061fbbd06dff90a06db42196862c09885f2
MD5 ec03fd024b61be4ddb7c4d21fb14a6af
SHA1 05b10ec4c7752784e94ed6e9d3e0984b7257088e
SHA512 7a25999338515b698efdc23632e337083a7f99be787b01029cbbb66084ca231464113668c1cc78f2d4b8d2d7507b49e2916669f45c2be6e164caf566fcf92193
SSDEEP 98304:Ok2MhcjQ42oUe6pa6HfLxF72jUZFd1DAW7najY+5Xn2a12B7wsaPANAFdwxRSv8x:xhOn651Ffeaajj2a29Sv75u1h6gR
TLSH
T115177D2662D402ECD0BBC07D8F4B9953EB72740D43756AFB05A045A25F67AE0AE3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-10-31_ec03fd024b61be4ddb7c4d21fb14a6af_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

File Explorer

2026-10-31_ec03fd024b61be4ddb7c4d21fb14a6af_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

.exe 18.0MB

2026-10-31_ec03fd024b61be4ddb7c4d21fb14a6af_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

IMPHASH 9140f9ecd60928b88355b2042a14f4ec
SHA256 e7037002bea04f7f34e7106cc529f061fbbd06dff90a06db42196862c09885f2
MD5 ec03fd024b61be4ddb7c4d21fb14a6af
SHA1 05b10ec4c7752784e94ed6e9d3e0984b7257088e
SHA512 7a25999338515b698efdc23632e337083a7f99be787b01029cbbb66084ca231464113668c1cc78f2d4b8d2d7507b49e2916669f45c2be6e164caf566fcf92193
SSDEEP 98304:Ok2MhcjQ42oUe6pa6HfLxF72jUZFd1DAW7najY+5Xn2a12B7wsaPANAFdwxRSv8x:xhOn651Ffeaajj2a29Sv75u1h6gR
TLSH
T115177D2662D402ECD0BBC07D8F4B9953EB72740D43756AFB05A045A25F67AE0AE3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

d5:a4:f9:10:b5:d2:a3:8c:c8:f6:45:d8:6d:a0:a9:3f:43:c7:16:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Oct 23, 2026

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0c:e9:54:4b:00:f2:74:34:81:46:32:56:9f:c6:c7:a2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 17, 2025 - Mar 25, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

13824352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_pton socket setsockopt ioctlsocket connect WSAGetLastError send WSAWaitForMultipleEvents WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent closesocket recv WSAStartup WSACleanup getaddrinfo freeaddrinfo inet_ntop WSASetLastError __WSAFDIsSet select

dxgi

CreateDXGIFactory1 CreateDXGIFactory CreateDXGIFactory2

pdh

PdhAddCounterW PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptHashData

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree PropVariantClear CoCreateInstance CoUninitialize GetHGlobalFromStream CreateStreamOnHGlobal CoInitializeEx

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext

kernel32

LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA ExitProcess GetConsoleOutputCP ReadConsoleW GetConsoleMode SetEnvironmentVariableW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetLocaleInfoW GetFileType DuplicateHandle FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetStartupInfoW InitializeSListHead IsValidLocale GetUserDefaultLCID EnumSystemLocalesW PeekNamedPipe FlushFileBuffers GlobalMemoryStatusEx GetSystemInfo GetDiskFreeSpaceExA GetLastError GetCurrentThread SetThreadPriority FreeLibrary LoadLibraryExA LoadLibraryA SetDllDirectoryA ReadFile CloseHandle CreatePipe WaitForSingleObject CreateProcessA GetTickCount GetProcAddress LoadLibraryExW SetDllDirectoryW MultiByteToWideChar GetStdHandle WriteFile SetHandleInformation GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetModuleFileNameW GlobalUnlock GlobalLock WideCharToMultiByte GetTimeZoneInformation LocalFree MoveFileExW RaiseException SetEvent ResetEvent CreateEventA FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx Sleep FindClose FindFirstFileW FindNextFileW GetSystemTimeAsFileTime MoveFileExA VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableA CreateDirectoryA CreateDirectoryW DeleteFileW GetFileAttributesA GetFileAttributesW GetFileSizeEx GetFinalPathNameByHandleW RemoveDirectoryW SetFilePointerEx CreateFile2 IsDebuggerPresent DebugBreak OutputDebugStringW SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentThreadId GetLogicalProcessorInformationEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetModuleHandleExW SetThreadGroupAffinity FormatMessageW GetCurrentProcessorNumber ReleaseSemaphore ReleaseMutex OpenSemaphoreW CreateMutexExW CreateSemaphoreExW QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetSystemTimePreciseAsFileTime GetCurrentDirectoryW OutputDebugStringA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW RtlUnwind VirtualAlloc VirtualFree GetLogicalProcessorInformation GetMaximumProcessorGroupCount GetMaximumProcessorCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP HeapReAlloc HeapSize HeapQueryInformation SetStdHandle SetEndOfFile GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetCurrentProcess RtlCaptureStackBackTrace RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetStringTypeW InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable GetNativeSystemInfo GetExitCodeThread SwitchToThread CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetLocaleInfoEx TryAcquireSRWLockExclusive GetTickCount64 CreateFileW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl

user32

GetLastInputInfo

advapi32

RegQueryValueExW RegCloseKey EventWriteTransfer EventSetInformation EventUnregister EventRegister SetNamedSecurityInfoW SetEntriesInAclW GetTokenInformation OpenProcessToken

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetTimeouts WinHttpQueryHeaders WinHttpSetOption WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash PathCchRemoveFileSpec

dbghelp

ImageDirectoryEntryToData SymFromAddr

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList

Name

.text

Size

13.8MB

Virtual Size

13.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

503KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

436KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_ec03fd024b61be4ddb7c4d21fb14a6af_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_poet-rat_remcos_stealc

ws2_32

dxgi

pdh

bcrypt

shell32

ole32

crypt32

kernel32

user32

advapi32

winhttp

api-ms-win-core-path-l1-1-0

dbghelp

setupapi

generic