2026-08-12_5d63584832a603fc02ae68aadc133b36_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_5d63584832a603fc02ae68aadc133b36_glassworm
Size 3.4MB
Sample260812-e7z97avzhs
SHA256 036fd4ad676267e438a635d3bba73e9767c035a32e69307cb5dc5dc08f0fc798
MD5 5d63584832a603fc02ae68aadc133b36
SHA1 d40a4d091eb3129f1a4cf2c2d2eb399fd005528a
SHA512 8dbc384b6cdffb5316556c38576f8aa4b8e6a12c307d9cb8c9f49960eec25ed75417cf7adcdf07e854ce525f864b439c974ac04f878ca4dcc165a642b2332f23
SSDEEP 49152:PGPd8xTIYxcMYubvE4Y14I6qQR8lM/yRi8SdaN04l1C1BAUZLYgiU7IZGaXBuQQ3:j5BvE4YeI3HuVZ4XC1BAUZLGN
TLSH
T174F59E43F2E361ECC627C13086576B73FA32FC2426216E7B6554FB352E71EA01A58B64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_5d63584832a603fc02ae68aadc133b36_glassworm

File Explorer

2026-08-12_5d63584832a603fc02ae68aadc133b36_glassworm

.exe 3.4MB

2026-08-12_5d63584832a603fc02ae68aadc133b36_glassworm

IMPHASH 87de9cae9f23177c3955e498b488d2c1
SHA256 036fd4ad676267e438a635d3bba73e9767c035a32e69307cb5dc5dc08f0fc798
MD5 5d63584832a603fc02ae68aadc133b36
SHA1 d40a4d091eb3129f1a4cf2c2d2eb399fd005528a
SHA512 8dbc384b6cdffb5316556c38576f8aa4b8e6a12c307d9cb8c9f49960eec25ed75417cf7adcdf07e854ce525f864b439c974ac04f878ca4dcc165a642b2332f23
SSDEEP 49152:PGPd8xTIYxcMYubvE4Y14I6qQR8lM/yRi8SdaN04l1C1BAUZLYgiU7IZGaXBuQQ3:j5BvE4YeI3HuVZ4XC1BAUZLGN
TLSH
T174F59E43F2E361ECC627C13086576B73FA32FC2426216E7B6554FB352E71EA01A58B64
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation GetUserNameA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDeriveKey BCryptDestroyHash BCryptDestroyKey BCryptDestroySecret BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGetProperty BCryptHashData BCryptImportKey BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSecretAgreement BCryptSetProperty BCryptSignHash BCryptVerifySignature

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringA CertOpenStore CertOpenSystemStoreA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryA PFXImportCertStore

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

iphlpapi

GetAdaptersInfo if_nametoindex

kernel32

AcquireSRWLockExclusive CancelIo CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FormatMessageA GetACP GetComputerNameA GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetOverlappedResult GetProcAddress GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetTickCount GetTickCount64 GetTimeZoneInformation GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LocalFree MapViewOfFile MoveFileExA MultiByteToWideChar OpenProcess PeekNamedPipe Process32First Process32Next QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseSRWLockExclusive SearchPathA SetConsoleOutputCP SetHandleInformation SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepEx TerminateProcess TlsGetValue UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeA WakeConditionVariable WriteFile

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbstowcs_s strtol strtoll strtoul strtoull wcrtomb wcstombs_s

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _findfirst64i32 _findnext64i32 _fstat64 _fullpath _lock_file _stat64 _unlink _unlock_file remove

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen ceil sqrt

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _close _fileno _fileno _fseeki64 _fsopen _lseeki64 _pclose _popen _read _setmode _sopen_s _write _write fclose feof ferror fflush fgets fopen fputc fread freopen_s fseek ftell fwrite getc puts rewind setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_strdup _strdup _stricmp _strnicmp isdigit isspace isupper isxdigit mbrlen memset strcat strcmp strcpy strcspn strlen strncmp strncpy strncpy_s strnlen strpbrk strspn tolower wcscpy_s wcslen wcsncmp wcsncpy_s wcsnlen

api-ms-win-crt-time-l1-1-0

_difftime64 _gmtime64_s _time64 strftime

api-ms-win-crt-utility-l1-1-0

bsearch qsort rand_s

secur32

InitSecurityInterfaceA

shell32

ShellExecuteA

user32

BlockInput CloseClipboard EnumWindows ExitWindowsEx FindWindowA GetClipboardData GetDC GetLastInputInfo GetSystemMetrics GetWindowTextA GetWindowThreadProcessId MessageBoxA OpenClipboard ReleaseDC SendInput SendMessageA SetProcessDPIAware SystemParametersInfoA

winmm

PlaySoundA mciSendStringA waveInAddBuffer waveInClose waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader

wldap32

ber_free ldap_bind_s ldap_err2string ldap_first_attribute ldap_first_entry ldap_get_dn ldap_get_values_len ldap_init ldap_memfree ldap_msgfree ldap_next_attribute ldap_next_entry ldap_search_s ldap_set_option ldap_simple_bind_s ldap_sslinit ldap_unbind_s ldap_value_free_len

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAStringToAddressW WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_5d63584832a603fc02ae68aadc133b36_glassworm

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

secur32

shell32

user32

winmm

wldap32

ws2_32

generic