9f156cb4bc9ef2c702c6020bcf6b454072e1983a0393a95731e073f5f5242b63

General

Target
2026-07-03_23f595ae006a042b29c17700745da207_amadey_glassworm_icedid_vidar
Size 20.7MB
Sample260703-23689sds9p
SHA256 9f156cb4bc9ef2c702c6020bcf6b454072e1983a0393a95731e073f5f5242b63
MD5 23f595ae006a042b29c17700745da207
SHA1 bf9e0001f7e0622d6157a490fa1640ec0ea347dd
SHA512 331816fabc24ac2178834944a1253acbed2d9928d36eff7c8acc8762ee683af29ece8ecb7551362771ff1f5d6e72e89a732265642ed52daec50762a5600c569e
SSDEEP 393216:PkfT50sYm1IRrfgeoOyQfkc9hPjmk1jycmab1FV//bzI:PhsY38cVr1lmOB3X
TLSH
T1102759A7B2404660E56FCE31676ABF78778B74C398CC41581FFAD01CDA81EAC1A95F48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-03_23f595ae006a042b29c17700745da207_amadey_glassworm_icedid_vidar
- Size 20.7MB
- SHA256 9f156cb4bc9ef2c702c6020bcf6b454072e1983a0393a95731e073f5f5242b63
- MD5 23f595ae006a042b29c17700745da207
- SHA1 bf9e0001f7e0622d6157a490fa1640ec0ea347dd
- SHA512 331816fabc24ac2178834944a1253acbed2d9928d36eff7c8acc8762ee683af29ece8ecb7551362771ff1f5d6e72e89a732265642ed52daec50762a5600c569e
- SSDEEP 393216:PkfT50sYm1IRrfgeoOyQfkc9hPjmk1jycmab1FV//bzI:PhsY38cVr1lmOB3X
- TLSH
  T1102759A7B2404660E56FCE31676ABF78778B74C398CC41581FFAD01CDA81EAC1A95F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

costura defense_evasion packer spyware stealer upx
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables manipulated with Fody
- Detects executables packed with Babel
- Detects executables packed with Dotfuscator
- Detects executables packed with Goliath
- Detects executables packed with SmartAssembly
- Detects executables packed with Yano Obfuscator
- Detects executables packed with dotNetProtector
- Detects executables referencing many base64-encoded IR and analysis tools names
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- UPX dump on OEP (original entry point)
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2