2026-07-13_2b1de3165eb7fe65a3c9124ef8cd31b3_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_2b1de3165eb7fe65a3c9124ef8cd31b3_glassworm_icedid
Size 19.9MB
Sample260714-b2rt3sev5y
SHA256 180e061174e1a9918595d58b4e7ac858d23dee69ec84880dfe4fec5d183c8f27
MD5 2b1de3165eb7fe65a3c9124ef8cd31b3
SHA1 793517ee3dabdd416b8c8eda23f714c04ad20270
SHA512 c1d2d2150ab67466588d8492cd78eac1cf85156138a796cf119dead68252868753299d7a19a2d8df6b2dc83a951d472bea5bbc4510df408dc9c3744e58d58747
SSDEEP 393216:5QPXwug1XUlEPY6YZ8JQ2SETosm1/O1JSNtz9d2unR:nXUlPWrMz9dl
TLSH
T19A279E8A62B010EBE07BD078D197622BD2B134571B30ABDF06B487AA1F23FE51D79751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-13_2b1de3165eb7fe65a3c9124ef8cd31b3_glassworm_icedid

File Explorer

2026-07-13_2b1de3165eb7fe65a3c9124ef8cd31b3_glassworm_icedid

.exe 19.9MB

2026-07-13_2b1de3165eb7fe65a3c9124ef8cd31b3_glassworm_icedid

IMPHASH 29ac7a5ffc8d8079facc015464e70263
SHA256 180e061174e1a9918595d58b4e7ac858d23dee69ec84880dfe4fec5d183c8f27
MD5 2b1de3165eb7fe65a3c9124ef8cd31b3
SHA1 793517ee3dabdd416b8c8eda23f714c04ad20270
SHA512 c1d2d2150ab67466588d8492cd78eac1cf85156138a796cf119dead68252868753299d7a19a2d8df6b2dc83a951d472bea5bbc4510df408dc9c3744e58d58747
SSDEEP 393216:5QPXwug1XUlEPY6YZ8JQ2SETosm1/O1JSNtz9d2unR:nXUlPWrMz9dl
TLSH
T19A279E8A62B010EBE07BD078D197622BD2B134571B30ABDF06B487AA1F23FE51D79751
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

05:6b:28:13:7f:84:5b:8a:ed:c5:26:60:9c:4f:42:cc:5d:4d:69:18

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Chains

Jun 13, 2014

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Serial Number

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 3, 2013 - Dec 4, 2015

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BuildServer\WoW\3\work\WoW-code\branches\wow-patch-5_4_8-branch-fastpatch-0\WoW\Bin\Wow-64.pdb

kernel32

SetFilePointerEx GetModuleHandleExW GetVersionExA GetACP GlobalMemoryStatusEx GetProcessTimes CreateEventA Process32NextW Process32FirstW GetCompressedFileSizeA CopyFileW GetFullPathNameA GetCommandLineW GetWindowsDirectoryA GetProcessAffinityMask SetPriorityClass GetPriorityClass LocalFree GetUserDefaultLangID CreateIoCompletionPort WaitForMultipleObjects GetQueuedCompletionStatus DuplicateHandle GlobalUnlock GlobalLock GlobalFree GlobalAlloc LocalAlloc RaiseException ResetEvent GetDriveTypeA GetSystemDirectoryA OpenEventA OpenFileMappingA TerminateJobObject SetInformationJobObject QueryInformationJobObject CreateJobObjectW CreateFileMappingW AssignProcessToJobObject CreateMutexA ReleaseMutex VerifyVersionInfoW VerSetConditionMask SetProcessAffinityMask HeapAlloc GetProcessHeap FormatMessageW FindFirstFileA CreateMutexW SetUnhandledExceptionFilter HeapFree ExitProcess CreateSemaphoreA CreateDirectoryA SetHandleInformation SetFileTime RtlAddFunctionTable FlushInstructionCache VirtualProtect GetEnvironmentVariableW GetStartupInfoW UnhandledExceptionFilter GetStdHandle SetConsoleCtrlHandler RtlUnwindEx RtlPcToFileHeader GetFullPathNameW ExitThread GetDateFormatA GetTimeFormatA HeapReAlloc FindFirstFileExA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation HeapCreate GetLocaleInfoW GetCPInfo GetOEMCP IsValidCodePage LCMapStringW HeapSize GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeW CompareStringW GetDriveTypeW PeekNamedPipe SetStdHandle GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW SetEnvironmentVariableA SetFileAttributesW SetEndOfFile RemoveDirectoryW SetFilePointer GetShortPathNameW GetDiskFreeSpaceExW FlushFileBuffers FindNextFileW ReadFile RtlLookupFunctionEntry RtlVirtualUnwind CreateFileMappingA MapViewOfFile WaitForSingleObjectEx UnmapViewOfFile GetTempPathA DeleteFileA GetSystemTimeAsFileTime DeleteFileW GetVolumeInformationW MoveFileW SetCurrentDirectoryW GetFileSize GetCompressedFileSizeW GetFileAttributesExW CreateFileA CreateThread GetDiskFreeSpaceW Module32Next Module32First Process32Next Process32First GetVersionExW TlsSetValue SetEnvironmentVariableW GetDiskFreeSpaceA WaitForMultipleObjectsEx WriteFileEx ReadFileEx MultiByteToWideChar GetCurrentDirectoryW GetModuleFileNameW FindFirstFileW FindClose QueryPerformanceFrequency TlsAlloc SetThreadAffinityMask FormatMessageA GetCurrentThreadId CreateToolhelp32Snapshot Thread32First OpenThread CancelIo MulDiv SignalObjectAndWait SearchPathW SetErrorMode ExpandEnvironmentStringsA SleepEx DebugActiveProcess IsProcessorFeaturePresent GetNativeSystemInfo GetSystemWindowsDirectoryW SetConsoleTextAttribute GetConsoleWindow AllocConsole SetConsoleTitleW GetConsoleScreenBufferInfo GetExitCodeThread MoveFileExW OutputDebugStringW SuspendThread GetThreadContext Thread32Next RtlCaptureContext VirtualFree VirtualAlloc GetComputerNameW CreateProcessW CreateDirectoryW GetFileAttributesW GetLocalTime VirtualQuery SetLastError SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetCurrentThread QueryPerformanceCounter TlsFree TlsGetValue GetThreadPriority SetThreadPriority TerminateThread ResumeThread GetCurrentProcessId Sleep GlobalMemoryStatus ReleaseSemaphore CreateSemaphoreW DeleteCriticalSection LeaveCriticalSection GetModuleHandleA EnterCriticalSection InitializeCriticalSection WaitForSingleObject SetEvent LoadLibraryA FreeLibrary GetProcAddress GetSystemInfo GetFileInformationByHandle GetFileSizeEx DeviceIoControl GetVersion GetCurrentProcess TerminateProcess CloseHandle WriteFile GetModuleFileNameA IsDebuggerPresent OutputDebugStringA GetOverlappedResult WideCharToMultiByte GetLastError CreateFileW CreateEventW GetComputerNameA LoadLibraryW GetTickCount RtlDeleteFunctionTable GetModuleHandleW

shell32

SHGetSpecialFolderPathA FindExecutableA SHGetFolderPathW ShellExecuteW ShellExecuteA

secur32

GetUserNameExW

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertFreeCertificateContext CertCloseStore CryptMsgClose CryptUnprotectData CertGetNameStringW CryptProtectData

gdi32

GetStockObject TranslateCharsetInfo ChoosePixelFormat GetPixelFormat SetDeviceGammaRamp DescribePixelFormat SetPixelFormat CreateDIBSection CreateBitmap DeleteObject DeleteDC StretchBlt BitBlt CreateCompatibleDC OffsetViewportOrgEx SetViewportOrgEx SelectClipRgn CreateRectRgn Rectangle CreateFontIndirectA GetObjectA SetMapMode GdiFlush SetBkMode CreateSolidBrush SetTextColor SetBkColor SelectObject GetDeviceGammaRamp

ole32

CoInitialize

wininet

InternetSetOptionA InternetConnectA InternetReadFileExA InternetOpenA HttpSendRequestA InternetSetCookieW HttpOpenRequestA InternetCrackUrlA InternetCloseHandle HttpQueryInfoA InternetSetStatusCallbackA

winmm

waveOutGetDevCapsA waveOutClose waveOutGetNumDevs waveInGetNumDevs mciSendCommandA timeGetTime waveOutOpen waveOutUnprepareHeader waveOutPrepareHeader waveInReset waveInClose waveInOpen waveInStart waveInGetDevCapsA waveInUnprepareHeader waveInPrepareHeader waveInAddBuffer waveOutGetPosition waveOutReset waveOutWrite

d3d9

D3DPERF_SetOptions

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

imm32

ImmReleaseContext ImmGetConversionStatus ImmGetContext ImmGetCompositionStringA ImmAssociateContext ImmSetConversionStatus ImmAssociateContextEx ImmNotifyIME ImmGetCandidateListA

msacm32

acmStreamPrepareHeader acmStreamConvert acmStreamUnprepareHeader acmFormatSuggest acmStreamOpen acmStreamSize

ws2_32

send getsockopt WSACleanup accept ioctlsocket select WSAGetLastError WSASetLastError WSAStartup setsockopt socket closesocket __WSAFDIsSet connect listen bind htons htonl WSAEventSelect WSAEnumNetworkEvents WSAAsyncGetHostByName freeaddrinfo recvfrom WSACloseEvent gethostbyname gethostname ntohl getpeername getsockname sendto recv inet_addr ntohs inet_ntoa WSAIoctl WSACancelAsyncRequest getaddrinfo WSACreateEvent

user32

GetDC GetClientRect ScreenToClient GetCursorPos UnregisterClassA SetClassLongPtrA CreateIconIndirect EnumDisplayDevicesA DefWindowProcA EndPaint BeginPaint SetWindowLongPtrA GetWindowLongPtrA RegisterClassExA LoadImageA CreateWindowExA AdjustWindowRectEx EnumDisplayMonitors ChangeDisplaySettingsExA MapWindowPoints SetCursorPos MapVirtualKeyA VkKeyScanA ClientToScreen GetAsyncKeyState SystemParametersInfoA UnhookWindowsHookEx SendInput SetCapture ReleaseCapture MoveWindow GetWindowPlacement SetFocus IsZoomed DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetWindowLongA GetPropA GetParent CloseClipboard GetClipboardData OpenClipboard IsIconic ReleaseDC MessageBeep MessageBoxW GetKeyState FillRect IsDialogMessageA TranslateAcceleratorA GetKeyboardLayout SetClipboardData EmptyClipboard LoadStringA MessageBoxA wsprintfA LoadBitmapA DefWindowProcW UnregisterClassW CreateWindowExW RegisterClassExW DrawTextExA InvertRect DrawTextExW SetTimer KillTimer GetActiveWindow IsWindow IsWindowVisible GetWindowRect SetWindowPos SendMessageA PostMessageA GetWindowTextW DestroyWindow DestroyIcon PeekMessageW GetMessageW IsDialogMessageW GetDesktopWindow CreateDialogParamW GetDlgItem LoadStringW SetWindowTextW ShowWindow PostQuitMessage SetWindowLongPtrW GetSystemMetrics LoadImageW SendMessageW GetForegroundWindow SetCursor EnumDisplaySettingsA ShowCursor ClipCursor GetMonitorInfoA WaitForInputIdle

iphlpapi

GetIfTable

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA ImpersonateLoggedOnUser GetUserNameA ConvertStringSecurityDescriptorToSecurityDescriptorW CryptGetHashParam OpenProcessToken CryptDestroyHash SetSecurityInfo InitializeAcl DuplicateTokenEx RevertToSelf CreateProcessAsUserW GetSecurityDescriptorDacl GetSecurityInfo GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorSacl SetSecurityDescriptorDacl SetEntriesInAclW CreateWellKnownSid BuildSecurityDescriptorW SetKernelObjectSecurity SetTokenInformation CreateRestrictedToken EqualSid CopySid LookupPrivilegeValueA CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenKey CryptExportKey CryptImportKey CryptEncrypt CryptAcquireContextW MakeAbsoluteSD MakeSelfRelativeSD GetLengthSid IsValidSid AddAce RegQueryValueExW RegOpenKeyExW RegFlushKey RegSetValueExW RegCreateKeyExW CryptGenRandom RegDeleteValueW CryptCreateHash CryptHashData

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpGetDefaultProxyConfiguration WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle

setupapi

SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA

Name

.text

Size

14.5MB

Virtual Size

14.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

968KB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

897KB

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=152, version=20115,

count=531, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=171, productName=VS2010 build 30319, version=30319,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=109, productName=VS2005 build 50727, version=50727,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=731, id=1, productName=Unmarked objects,

count=1850, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=31, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=151,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,