2026-08-12_82423504c43fdac1a44f4ea3d046c792_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_82423504c43fdac1a44f4ea3d046c792_glassworm
Size 3.4MB
Sample260812-e48gdsvzcx
SHA256 94f5357dd71d2576903f811f294f0c43a66dc6007119956b3d6e67f46bda28c9
MD5 82423504c43fdac1a44f4ea3d046c792
SHA1 6819b49d159f7d71ef8c4654bd315020025ce043
SHA512 5588da4c203d36f1df40c6dd5f25f98375ddb999f3dbcc48389637e29ab7c0ce0fca9f7bc840047766d8632cf73a31351a324c8f81486082cd20fda8adc6f6b1
SSDEEP 49152:FqI6Wz9r79uxeQO1D8r5AgKPlwlBBTcMGk6fZMG341BAUZLYgiU7IZGaXBuQQ9el:hBQxeQO1IrmNiwPZMm41BAUZLGN
TLSH
T13EF59E43F2E361ECC627C1308657A773FA32FC2426216E7B6554FB342E71EA01A58B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_82423504c43fdac1a44f4ea3d046c792_glassworm

File Explorer

2026-08-12_82423504c43fdac1a44f4ea3d046c792_glassworm

.exe 3.4MB

2026-08-12_82423504c43fdac1a44f4ea3d046c792_glassworm

IMPHASH 3afadfd3e44630fb2b480000d30e20be
SHA256 94f5357dd71d2576903f811f294f0c43a66dc6007119956b3d6e67f46bda28c9
MD5 82423504c43fdac1a44f4ea3d046c792
SHA1 6819b49d159f7d71ef8c4654bd315020025ce043
SHA512 5588da4c203d36f1df40c6dd5f25f98375ddb999f3dbcc48389637e29ab7c0ce0fca9f7bc840047766d8632cf73a31351a324c8f81486082cd20fda8adc6f6b1
SSDEEP 49152:FqI6Wz9r79uxeQO1D8r5AgKPlwlBBTcMGk6fZMG341BAUZLYgiU7IZGaXBuQQ9el:hBQxeQO1IrmNiwPZMm41BAUZLGN
TLSH
T13EF59E43F2E361ECC627C1308657A773FA32FC2426216E7B6554FB342E71EA01A58B65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation GetUserNameA OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDeriveKey BCryptDestroyHash BCryptDestroyKey BCryptDestroySecret BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGetProperty BCryptHashData BCryptImportKey BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSecretAgreement BCryptSetProperty BCryptSignHash BCryptVerifySignature

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringA CertOpenStore CertOpenSystemStoreA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryA PFXImportCertStore

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

iphlpapi

GetAdaptersInfo if_nametoindex

kernel32

AcquireSRWLockExclusive CancelIo CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FormatMessageA FreeLibrary GetACP GetComputerNameA GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetOverlappedResult GetProcAddress GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetTickCount GetTickCount64 GetTimeZoneInformation GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LocalFree MapViewOfFile MoveFileExA MultiByteToWideChar OpenProcess PeekNamedPipe Process32First Process32Next QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseSRWLockExclusive SearchPathA SetConsoleOutputCP SetHandleInformation SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepEx TerminateProcess TlsGetValue UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeA WakeConditionVariable WriteFile

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbstowcs_s strtol strtoll strtoul strtoull wcrtomb wcstombs_s

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _findfirst64i32 _findnext64i32 _fstat64 _fullpath _lock_file _stat64 _unlink _unlock_file remove

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen ceil sqrt

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fileno _fileno _fseeki64 _fsopen _lseeki64 _pclose _popen _read _setmode _sopen_s _write _write fclose feof ferror fflush fgets fopen fputc fread freopen_s fseek ftell fwrite getc puts rewind setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_strdup _strdup _stricmp _strnicmp isdigit isspace isupper isxdigit mbrlen memset strcat strcmp strcpy strcspn strlen strncmp strncpy strncpy_s strnlen strpbrk strspn tolower wcscpy_s wcslen wcsncmp wcsncpy_s wcsnlen

api-ms-win-crt-time-l1-1-0

_difftime64 _gmtime64_s _time64 strftime

api-ms-win-crt-utility-l1-1-0

bsearch qsort rand_s

secur32

InitSecurityInterfaceA

shell32

SHGetFolderPathA ShellExecuteA

user32

BlockInput CloseClipboard EnumWindows ExitWindowsEx FindWindowA GetClipboardData GetDC GetLastInputInfo GetSystemMetrics GetWindowThreadProcessId MessageBoxA OpenClipboard ReleaseDC SendInput SendMessageA SetProcessDPIAware SystemParametersInfoA

winmm

PlaySoundA mciSendStringA waveInAddBuffer waveInClose waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader

wldap32

ber_free ldap_bind_s ldap_err2string ldap_first_attribute ldap_first_entry ldap_get_dn ldap_get_values_len ldap_init ldap_memfree ldap_msgfree ldap_next_attribute ldap_next_entry ldap_search_s ldap_set_option ldap_simple_bind_s ldap_sslinit ldap_unbind_s ldap_value_free_len

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAStringToAddressW WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getpeername getsockname getsockopt htonl htons inet_ntoa ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_82423504c43fdac1a44f4ea3d046c792_glassworm

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

secur32

shell32

user32

winmm

wldap32

ws2_32

generic