2026-11-09_322e8c03bd866aec8d8bdea5ac285b4e_akira_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_322e8c03bd866aec8d8bdea5ac285b4e_akira_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc
Size 4.2MB
Sample261110-26hebacb87
SHA256 4a84743e8cf033fb1490f32d247bd4e9e719146192487a6b717dc0003f69667f
MD5 322e8c03bd866aec8d8bdea5ac285b4e
SHA1 80e3585919f86d0ac7b31bdffa3ba2dbf9b05f76
SHA512 cf76ee894fda4a1d592c305c6aa32bdc9453f32ca629c638f8193383f96eaffcda69822675a731cc61232d2003938d45eceba9c5db36db6c7bd1c59cb875e560
SSDEEP 98304:TTXKfI6lgKyeo2bQibGahkV9kyfgLHVG7LGpi+jaz:XXKuBUbGahkV9kyfgLHAmIz
TLSH
T10B268E2776E901F8D0B7C1B9CAA78613E772B4190335A7DF16E086561F236E1AE3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-09_322e8c03bd866aec8d8bdea5ac285b4e_akira_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

.exe 4.2MB

2026-11-09_322e8c03bd866aec8d8bdea5ac285b4e_akira_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

IMPHASH 06ab5221f0e2cba2750b62dd3d2cdeac
SHA256 4a84743e8cf033fb1490f32d247bd4e9e719146192487a6b717dc0003f69667f
MD5 322e8c03bd866aec8d8bdea5ac285b4e
SHA1 80e3585919f86d0ac7b31bdffa3ba2dbf9b05f76
SHA512 cf76ee894fda4a1d592c305c6aa32bdc9453f32ca629c638f8193383f96eaffcda69822675a731cc61232d2003938d45eceba9c5db36db6c7bd1c59cb875e560
SSDEEP 98304:TTXKfI6lgKyeo2bQibGahkV9kyfgLHVG7LGpi+jaz:XXKuBUbGahkV9kyfgLHAmIz
TLSH
T10B268E2776E901F8D0B7C1B9CAA78613E772B4190335A7DF16E086561F236E1AE3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

20:55:81:0e:41:ba:2e:59:1c:da:59:5a:22:21:46:40:95:90:1a:60:c6:f1:e1:64:23:73:57:17:7a:14:70:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=CYBERMID LIMITED,O=CYBERMID LIMITED,L=New York,ST=New York,C=US

Chains

Nov 4, 2026

CN=CYBERMID LIMITED,O=CYBERMID LIMITED,L=New York,ST=New York,C=US

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=CYBERMID LIMITED,O=CYBERMID LIMITED,L=New York,ST=New York,C=US

Serial Number

33:00:0a:90:15:b1:25:62:bd:3f:89:33:9c:00:00:00:0a:90:15

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2026 - Nov 6, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

2755416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

bind closesocket htonl htons inet_ntoa WSAGetLastError __WSAFDIsSet select WSASetLastError recv send connect WSAStartup setsockopt WSACleanup socket accept getsockname getsockopt recvfrom listen

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertFindCertificateInStore CryptStringToBinaryW CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore

bcrypt

BCryptGenRandom

advapi32

CryptCreateHash SystemFunction036 RegDeleteTreeW RegDeleteKeyW RegDeleteKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey ConvertSidToStringSidW GetTokenInformation OpenProcessToken CryptReleaseContext CryptGetHashParam CryptAcquireContextW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData

secur32

InitSecurityInterfaceW

ws2_32

WSAWaitForMultipleEvents inet_pton getaddrinfo freeaddrinfo WSACloseEvent getpeername WSAEnumNetworkEvents WSACreateEvent WSAEventSelect WSAIoctl WSAResetEvent ntohs sendto gethostname

iphlpapi

if_nametoindex

shell32

SHChangeNotify Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteW

user32

PostQuitMessage RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetTimer KillTimer PostMessageW DestroyMenu TrackPopupMenu SetForegroundWindow GetCursorPos LoadIconW DestroyIcon IsWindowVisible SetWindowTextW DispatchMessageW TranslateMessage GetMessageW GetWindowTextW GetWindowTextLengthW GetWindowRect EnumWindows GetClassNameW GetWindowThreadProcessId RegisterWindowMessageW MessageBoxW DefWindowProcW GetSystemMetrics TrackMouseEvent InvalidateRect PeekMessageW CharLowerBuffW AppendMenuW CreatePopupMenu GetMonitorInfoW MonitorFromPoint LoadCursorW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient SetCursor RedrawWindow ValidateRect SetFocus SetWindowPos LoadImageW

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

dbghelp

MiniDumpWriteDump

powrprof

PowerUnregisterSuspendResumeNotification PowerRegisterSuspendResumeNotification

winhttp

WinHttpWebSocketReceive WinHttpOpen WinHttpCloseHandle WinHttpWebSocketQueryCloseStatus WinHttpConnect WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpWebSocketCompleteUpgrade WinHttpWebSocketSend WinHttpWebSocketClose

d2d1

ord1

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice

d3d11

D3D11CreateDevice

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW GetCommandLineA ExitProcess SetFilePointerEx GetConsoleOutputCP GetTimeZoneInformation SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount ReadConsoleW RtlUnwindEx GetStartupInfoW InitializeSListHead CompareStringW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer IsProcessorFeaturePresent CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns WakeAllConditionVariable WakeConditionVariable GetExitCodeThread InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetEndOfFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize GetFileSizeEx CreateThread GetEnvironmentVariableA PeekNamedPipe ReadFile GetFileType UnhandledExceptionFilter WriteFile VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx DebugBreak CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcessId GetCurrentThreadId FreeLibrary GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW FormatMessageW WideCharToMultiByte MultiByteToWideChar IsDebuggerPresent OutputDebugStringW SetLastError ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW CreateFileW SetUnhandledExceptionFilter SetErrorMode GetCurrentProcess CreateMutexW LocalFree FlushFileBuffers RtlUnwind MoveFileExW WaitForMultipleObjects TerminateProcess CreateProcessW OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW DuplicateHandle CreateEventW DeleteFileW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW GetCommandLineW SetEvent OpenEventW GetDiskFreeSpaceExW GetVolumeInformationW ReadProcessMemory GetFinalPathNameByHandleW QueryPerformanceCounter QueryPerformanceFrequency MulDiv FindClose FindFirstFileW FindNextFileW CopyFileW Sleep GetStdHandle GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualProtect RaiseException ResetEvent CreateEventA FormatMessageA GetSystemTimeAsFileTime MoveFileExA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx GetFullPathNameW

ole32

CoInitializeEx CoCreateInstance CreateStreamOnHGlobal PropVariantClear CoTaskMemFree CoUninitialize CoTaskMemAlloc

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

888KB

Virtual Size

888KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_322e8c03bd866aec8d8bdea5ac285b4e_akira_blankgrabber_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc

wsock32

crypt32

bcrypt

advapi32

secur32

ws2_32

iphlpapi

shell32

user32

rpcrt4

dbghelp

powrprof

winhttp

d2d1

dwrite

dcomp

d3d11

kernel32

ole32

generic