2026-08-13_010e7332eb9dc9a7bcba54d700ad7ab7_glassworm_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_010e7332eb9dc9a7bcba54d700ad7ab7_glassworm_icedid_vidar
Size 2.6MB
Sample260813-xdsx5aek21
SHA256 36f94ee4e94592d36a2413f07aaf3ef847c80292cecd064df022f2dbaa23aae2
MD5 010e7332eb9dc9a7bcba54d700ad7ab7
SHA1 004c0169e0acfd7583a919a103ee04e275e0beba
SHA512 6c81dcd176b80952c6394c15efa93c9bb460d62c8627d2b3a6c722dd7a2945f12d2b6f71def8fb97e90c9d377984658da664105f0ac10b2104245d41a448815f
SSDEEP 49152:boqatglJ+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglDT:aQQQsT
TLSH
T17BC50A45FA8580B2E477023148AB82BE5670B915CF139E9FB2449B9DBFB37C09E31671
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_010e7332eb9dc9a7bcba54d700ad7ab7_glassworm_icedid_vidar

File Explorer

2026-08-13_010e7332eb9dc9a7bcba54d700ad7ab7_glassworm_icedid_vidar

.exe 2.6MB

2026-08-13_010e7332eb9dc9a7bcba54d700ad7ab7_glassworm_icedid_vidar

IMPHASH a220beeafc75603adf8a3e0eebda23d9
SHA256 36f94ee4e94592d36a2413f07aaf3ef847c80292cecd064df022f2dbaa23aae2
MD5 010e7332eb9dc9a7bcba54d700ad7ab7
SHA1 004c0169e0acfd7583a919a103ee04e275e0beba
SHA512 6c81dcd176b80952c6394c15efa93c9bb460d62c8627d2b3a6c722dd7a2945f12d2b6f71def8fb97e90c9d377984658da664105f0ac10b2104245d41a448815f
SSDEEP 49152:boqatglJ+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglDT:aQQQsT
TLSH
T17BC50A45FA8580B2E477023148AB82BE5670B915CF139E9FB2449B9DBFB37C09E31671
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

df:55:38:af:52:0a:60:a3:ed:b5:cf:a6:28:ff:ed:17:e8:cc:4e:d3:3e:d2:f4:8b:de:87:93:06:60:76:e5:9d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

7f:62:2e:a4:66:2d:8d:5d:3a:97:4b:c6:21:3e:7c:6c:06:46:51:94

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:89:62:0d:9e:95:d3:61:6b:a8:00:00:00:00:00:89

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:c6:fe:ea:06:36:34:01:16:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Minor OS version

Major OS version

Entry point

19328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

diagtrackrunner.pdb

advapi32

EventWriteTransfer RegCreateKeyExW RegDeleteValueW RegGetValueW RegCloseKey OpenThreadToken

kernel32

LoadLibraryExW SetEnvironmentVariableW GetModuleHandleExW OutputDebugStringW GetModuleHandleW GetCurrentThread FormatMessageW RaiseException GetLastError SetLastError GetProcAddress GetModuleFileNameA GetCurrentThreadId CloseHandle ExpandEnvironmentStringsW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount TerminateProcess

msvcrt

_CxxThrowException ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ _callnewh _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode _commode ?terminate@@YAXXZ _lock _unlock __dllonexit _onexit ??1type_info@@UEAA@XZ _purecall _vsnwprintf malloc memcpy _initterm __CxxFrameHandler3 free memmove _wcsicmp ??3@YAXPEAX@Z ??0exception@@QEAA@AEBQEBDH@Z memset

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

userenv

ExpandEnvironmentStringsForUserW

diagtrack

RunDll32Main

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_010e7332eb9dc9a7bcba54d700ad7ab7_glassworm_icedid_vidar

PE Signature issue

PE Signature issue

advapi32

kernel32

msvcrt

ntdll

userenv

diagtrack

generic