0a18b8d03593f3f80ab77a5578dde7ca6e084568dc561675c7079d8592d8e115

General

Target
2026-08-25_b809c0857592a84f77e20fdf3f9a451d_glassworm_icedid
Size 6.7MB
Sample260826-pgaa7adb86
SHA256 0a18b8d03593f3f80ab77a5578dde7ca6e084568dc561675c7079d8592d8e115
MD5 b809c0857592a84f77e20fdf3f9a451d
SHA1 b206dd3d28423a3ff782f59864a2278fda16fa13
SHA512 3c54a3625906e7da2fe4debae596a598884fa722e6013aeecb63809b49476e4e4f7b7c73045dfbfcb045373e03eb7f9d33f121d1bce688fbbe845dfa062636ad
SSDEEP 98304:2YQZgmFNtgF26ox1qgIk6m0RknUSxZWWjeHaFMPFi77a:FQXqhoqk30RlSxZVMPC7a
TLSH
T12C66CF8667EC00F8E6B78239CC264956DBB2BC250722C7DF0159166E1FB37624DA6337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-25_b809c0857592a84f77e20fdf3f9a451d_glassworm_icedid
- Size 6.7MB
- SHA256 0a18b8d03593f3f80ab77a5578dde7ca6e084568dc561675c7079d8592d8e115
- MD5 b809c0857592a84f77e20fdf3f9a451d
- SHA1 b206dd3d28423a3ff782f59864a2278fda16fa13
- SHA512 3c54a3625906e7da2fe4debae596a598884fa722e6013aeecb63809b49476e4e4f7b7c73045dfbfcb045373e03eb7f9d33f121d1bce688fbbe845dfa062636ad
- SSDEEP 98304:2YQZgmFNtgF26ox1qgIk6m0RknUSxZWWjeHaFMPFi77a:FQXqhoqk30RlSxZVMPC7a
- TLSH
  T12C66CF8667EC00F8E6B78239CC264956DBB2BC250722C7DF0159166E1FB37624DA6337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing commands for clearing Windows Event Logs
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2