2026-08-02_0a212aae10fbd831f797ca601fd06647_ghostlocker_glassworm_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_0a212aae10fbd831f797ca601fd06647_ghostlocker_glassworm_vidar
Size 19.5MB
Sample260802-k6cemazdle
SHA256 6313a7ed0422645cb5e8e3e15a3dbe7bdb564889c79b22067a06a4f609a55cab
MD5 0a212aae10fbd831f797ca601fd06647
SHA1 05d421b51ee7a7ff95ca2dd01b17a1489312fb7a
SHA512 0b579b1794eed7cece0f4424fe06af9e73912abe85db969d3ffdeee75ff4ee3af4f729abc96b5ceb4687a32753e1132cd43fa8b16a1b98f31e32e7b0c9210c83
SSDEEP 393216:XcqsNEV3q7c7tTF9/f7tSV3/WM0VIXTul4:dbVaKth9/zeAer
TLSH
T1DA27F103A3D18A7EC495A234D187172AF274BC440B765ADBBB9C56202F33BD9CD7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_0a212aae10fbd831f797ca601fd06647_ghostlocker_glassworm_vidar

File Explorer

2026-08-02_0a212aae10fbd831f797ca601fd06647_ghostlocker_glassworm_vidar

.exe 19.5MB

2026-08-02_0a212aae10fbd831f797ca601fd06647_ghostlocker_glassworm_vidar

IMPHASH e4a8735eb5e96e05f788654d2f4c6513
SHA256 6313a7ed0422645cb5e8e3e15a3dbe7bdb564889c79b22067a06a4f609a55cab
MD5 0a212aae10fbd831f797ca601fd06647
SHA1 05d421b51ee7a7ff95ca2dd01b17a1489312fb7a
SHA512 0b579b1794eed7cece0f4424fe06af9e73912abe85db969d3ffdeee75ff4ee3af4f729abc96b5ceb4687a32753e1132cd43fa8b16a1b98f31e32e7b0c9210c83
SSDEEP 393216:XcqsNEV3q7c7tTF9/f7tSV3/WM0VIXTul4:dbVaKth9/zeAer
TLSH
T1DA27F103A3D18A7EC495A234D187172AF274BC440B765ADBBB9C56202F33BD9CD7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

crypt32

CryptProtectData CryptUnprotectData

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmIsCompositionEnabled

gdi32

CreateRectRgn DeleteObject GetDeviceCaps GetStockObject

ole32

CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetFolderPathW ShellExecuteW

user32

AllowSetForegroundWindow BringWindowToTop ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard EnumChildWindows EnumWindows FlashWindowEx GetCapture GetClassNameA GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowTextA GetWindowThreadProcessId IsWindow IsWindowUnicode LoadCursorW LoadIconW MonitorFromWindow OpenClipboard PeekMessageW PostMessageA PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowPos ShowWindow ShowWindowAsync TrackMouseEvent TranslateMessage UnregisterClassW

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fileno _fseeki64 _ftelli64 _get_osfhandle _setmode _wfopen _wopen fclose fflush fopen fputc fputwc fread fseek ftell fwrite getc setbuf setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strncpy strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __p__acmdln __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror strerror_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l _time64

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acosf atan2f ceilf cosf expf fmodf log logf lroundf pow powf sinf sqrtf truncf

api-ms-win-crt-convert-l1-1-0

_strtod_l atof mbrtowc mbsrtowcs strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateHardLinkW CreateRemoteThread CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushInstructionCache FormatMessageA FormatMessageW FreeLibrary GetActiveProcessorCount GetCurrentDirectoryW GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetLastError GetLocaleInfoA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadResource LocalFree LockResource Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseSRWLockExclusive ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadContext SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SuspendThread SwitchToThread Thread32First Thread32Next TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17.0MB

Virtual Size

17.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_0a212aae10fbd831f797ca601fd06647_ghostlocker_glassworm_vidar

bcrypt

crypt32

d3d11

d3dcompiler_47

dwmapi

gdi32

ole32

shell32

user32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic