2026-11-01_ef4950bb869697cf30ba2568ad869645_gazer_glassworm_helldown_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_ef4950bb869697cf30ba2568ad869645_gazer_glassworm_helldown_remcos
Size 2.3MB
Sample261102-ec649ast9n
SHA256 585e0f2a3d42c0373b09b53885c2492ac06bed5d28039127a48ae7d3804f2044
MD5 ef4950bb869697cf30ba2568ad869645
SHA1 7dc43fcd133ab256ae75c54aba05b185fbc70b29
SHA512 b51d8855a0e970adf6f8df66df2267022199da37870a4e348bb413730f93566c1d28a85a5b9886d9de4c58ad458f95b7db6c96c94ec4d3d84e6d09484d18456e
SSDEEP 49152:npSqY0yngUyWpSqdCdUdHdidYd4Q37NbH9VeazXF2z25i12dVdxdsdJdod0dmdu/:/UncTB1x
TLSH
T1B5B5293796DA4CAAD8E35338BFCB42B56B35FDA2CA28524F0684D510BC87190AF5D7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_ef4950bb869697cf30ba2568ad869645_gazer_glassworm_helldown_remcos

File Explorer

2026-11-01_ef4950bb869697cf30ba2568ad869645_gazer_glassworm_helldown_remcos

.exe 2.3MB

2026-11-01_ef4950bb869697cf30ba2568ad869645_gazer_glassworm_helldown_remcos

IMPHASH 9dbe5ab08914fc5e95c0a2466f03aafa
SHA256 585e0f2a3d42c0373b09b53885c2492ac06bed5d28039127a48ae7d3804f2044
MD5 ef4950bb869697cf30ba2568ad869645
SHA1 7dc43fcd133ab256ae75c54aba05b185fbc70b29
SHA512 b51d8855a0e970adf6f8df66df2267022199da37870a4e348bb413730f93566c1d28a85a5b9886d9de4c58ad458f95b7db6c96c94ec4d3d84e6d09484d18456e
SSDEEP 49152:npSqY0yngUyWpSqdCdUdHdidYd4Q37NbH9VeazXF2z25i12dVdxdsdJdod0dmdu/:/UncTB1x
TLSH
T1B5B5293796DA4CAAD8E35338BFCB42B56B35FDA2CA28524F0684D510BC87190AF5D7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msys-2.0

__cxa_atexit __errno __getreent __locale_ctype_ptr __main __wrap__Znwm __wrap__ZnwmRKSt9nothrow_t _dll_crt0 _impure_ptr arc4random_buf atoi calloc clock_gettime cygwin_internal dll_dllcrt0 fclose fgets fopen fprintf fread free fseek ftell fwrite gmtime_r isalnum malloc memchr memcmp memcpy memmove memset msys_detach_dll nanosleep posix_memalign printf putchar puts rand realloc remove rename setbuf snprintf sprintf sscanf strcmp strcpy strlen strncmp strtod strtoul time tolower

msys-gcc_s-seh-1

_Unwind_Resume __udivti3

msys-stdc++-6

_ZNKSt9basic_iosIcSt11char_traitsIcEEcvbEv _ZNSirsERj _ZNSt6chrono3_V212steady_clock3nowEv _ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEC1ERKNS_12basic_stringIcS2_S3_EESt13_Ios_Openmode _ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEED1Ev _ZSt17__throw_bad_allocv _ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base _ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt21__glibcxx_assert_failPKciS0_S0_ _ZSt24__throw_out_of_range_fmtPKcz _ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_ _ZSt28__throw_bad_array_new_lengthv _ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_ _ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZStrsIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZdlPvm _Znwm _ZnwmRKSt9nothrow_t __cxa_begin_catch __cxa_end_catch __cxa_guard_acquire __cxa_guard_release __cxa_rethrow __gxx_personality_seh0

kernel32

GetModuleHandleA

Name

.text

Size

913KB

Virtual Size

912KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1024B

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

131B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1024B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_ef4950bb869697cf30ba2568ad869645_gazer_glassworm_helldown_remcos

msys-2.0

msys-gcc_s-seh-1

msys-stdc++-6

kernel32

generic