2026-09-16_e31eb17695c4a63fbf903baaeea67694_akira_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_e31eb17695c4a63fbf903baaeea67694_akira_glassworm_icedid
Size 13.7MB
Sample260916-tkz38sdk5w
SHA256 7ed3a24e8a3d944ae74e1c6572fc4b5a8ab037519edaee05b489de56c302fef5
MD5 e31eb17695c4a63fbf903baaeea67694
SHA1 31562147cfbf749f4fa138e0f954d153abeb9d71
SHA512 e436ae21d1809932afc4f90fc61637606c8dce837d4749324c0a04bf863e49feab3a290e75039bd5776c0ad0dbc167ff8989f7285e9706e1de6c8fc168848d6b
SSDEEP 98304:hWbOij3SyxjZB3zNQTIroKrp/MLv+aBhFtz3bQgY/3QS5+QV:nZKr0nBpsgu3Qa
TLSH
T1C7E68E03F64591EDC06EC0B4839AD637FB76B8890A24B2AF1BD906213E76F505F5E349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_e31eb17695c4a63fbf903baaeea67694_akira_glassworm_icedid

File Explorer

2026-09-16_e31eb17695c4a63fbf903baaeea67694_akira_glassworm_icedid

.exe 13.7MB

2026-09-16_e31eb17695c4a63fbf903baaeea67694_akira_glassworm_icedid

IMPHASH f29241e4fb9e96ac0eed1a6622720ad0
SHA256 7ed3a24e8a3d944ae74e1c6572fc4b5a8ab037519edaee05b489de56c302fef5
MD5 e31eb17695c4a63fbf903baaeea67694
SHA1 31562147cfbf749f4fa138e0f954d153abeb9d71
SHA512 e436ae21d1809932afc4f90fc61637606c8dce837d4749324c0a04bf863e49feab3a290e75039bd5776c0ad0dbc167ff8989f7285e9706e1de6c8fc168848d6b
SSDEEP 98304:hWbOij3SyxjZB3zNQTIroKrp/MLv+aBhFtz3bQgY/3QS5+QV:nZKr0nBpsgu3Qa
TLSH
T1C7E68E03F64591EDC06EC0B4839AD637FB76B8890A24B2AF1BD906213E76F505F5E349
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9178640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFinalPathNameByHandleW CreateMutexA GetLastError WaitForSingleObjectEx ExitProcess FindFirstFileExW MoveFileExW CopyFileExW RemoveDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetExitCodeProcess WaitForMultipleObjects GetStdHandle DuplicateHandle CreateProcessW GetWindowsDirectoryW GetFileInformationByHandleEx SetFileInformationByHandle SetFileTime SetStdHandle GetFileType HeapSize RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW SetHandleInformation DeleteFileW CreateThread GetFullPathNameW WriteFileEx SleepEx ReadFileEx LocalFree GetFileInformationByHandle SetNamedPipeHandleState CreateFileW CancelIoEx WriteFile GetOverlappedResult ReadFile SetFileCompletionNotificationModes GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort UnmapViewOfFile GetSystemInfo HeapAlloc GetCurrentThreadId GetSystemDirectoryW WriteConsoleW SetLastError GetConsoleMode GetProcessTimes TerminateProcess QueryFullProcessImageNameW GetLocalTime GetDriveTypeW GetLogicalDriveStringsW WaitNamedPipeW DisconnectNamedPipe FlushFileBuffers ConnectNamedPipe OpenProcess CreateNamedPipeW GetComputerNameW CreateMutexW WaitForSingleObject FindClose GetConsoleOutputCP CreateWaitableTimerExW GetCurrentThread GlobalFree GlobalSize GlobalUnlock GlobalAlloc GlobalLock Beep SetWaitableTimer GetFileAttributesW GetCurrentProcess GetSystemTimePreciseAsFileTime GetCurrentProcessId HeapReAlloc RtlPcToFileHeader SwitchToThread ReleaseMutex HeapFree GetProcessHeap GetTempPathW TlsFree GetModuleHandleA Sleep CloseHandle GetModuleFileNameW SetThreadErrorMode FreeLibrary LoadLibraryExW GetProcAddress LeaveCriticalSection TlsSetValue TlsGetValue EnterCriticalSection RaiseException EncodePointer RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW TlsAlloc CancelIo FindNextFileW SetFileAttributesW RtlDeleteFunctionTable SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleExW VirtualAlloc VirtualProtect AddVectoredContinueHandler VirtualFree RtlAddFunctionTable RemoveVectoredExceptionHandler RemoveVectoredContinueHandler FlushInstructionCache InitializeCriticalSectionAndSpinCount FormatMessageW DeleteCriticalSection LCMapStringW WideCharToMultiByte MultiByteToWideChar GetUserDefaultGeoName GetTimeZoneInformation K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryW Module32FirstW Module32NextW CompareStringOrdinal QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW LoadLibraryA GetModuleHandleW GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetStringTypeW CompareStringW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

OpenProcessToken GetTokenInformation RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW ImpersonateAnonymousToken SystemFunction036 RegGetValueW

ws2_32

getpeername getsockname shutdown getsockopt getaddrinfo WSAStartup WSASocketW connect bind ioctlsocket setsockopt WSAGetLastError WSAIoctl WSACleanup freeaddrinfo WSASend send closesocket recv

ntdll

NtCancelIoFileEx NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtReadFile NtQuerySystemInformation NtWriteFile

opengl32

wglGetCurrentContext wglCreateContext wglShareLists wglGetCurrentDC wglGetProcAddress wglDeleteContext wglMakeCurrent

shlwapi

AssocQueryStringW

user32

ValidateRect SetCapture GetRawInputData SetWindowLongPtrW IsProcessDPIAware RegisterTouchWindow GetTouchInputInfo CloseTouchInputHandle CreateWindowExW RegisterClassExW DefWindowProcW GetClassInfoExW GetWindowTextLengthW GetWindowTextW SetWindowTextW ShowWindow GetSystemMenu EnableMenuItem GetClassNameW GetWindowPlacement GetDC FlashWindowEx SetWindowLongW GetForegroundWindow InvalidateRgn SetCursorPos ClientToScreen GetClientRect MonitorFromPoint SendMessageW GetSystemMetrics GetActiveWindow ReleaseDC CreateIconFromResourceEx RegisterRawInputDevices TranslateMessage DispatchMessageW GetWindowLongPtrW ScreenToClient DestroyWindow RedrawWindow GetAncestor IsWindowVisible GetWindowThreadProcessId EnumWindows CloseClipboard RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable OpenClipboard SetClipboardData EmptyClipboard GetMonitorInfoW EnumDisplayMonitors MessageBoxW MonitorFromWindow GetWindowRect IsIconic GetMenu GetWindowLongW AdjustWindowRectEx ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW CreateIcon GetClipCursor ClipCursor ShowCursor SetWindowDisplayAffinity RegisterWindowMessageA DestroyCursor DestroyIcon MsgWaitForMultipleObjectsEx SendInput SetForegroundWindow SystemParametersInfoA TrackMouseEvent MapVirtualKeyW GetKeyboardState GetAsyncKeyState SetWindowPos MonitorFromRect PostMessageW GetKeyState LoadCursorW SetCursor ChangeDisplaySettingsExW SetWindowPlacement GetCursorPos PeekMessageW ReleaseCapture

shell32

DragFinish DragQueryFileW ShellExecuteW

gdi32

DeleteObject ChoosePixelFormat CreateRectRgn SwapBuffers GetDeviceCaps SetPixelFormat DescribePixelFormat

winmm

PlaySoundW

fltlib

FilterSendMessage FilterConnectCommunicationPort

wintrust

CryptCATAdminReleaseContext CryptCATAdminAcquireContext2 CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext CryptCATAdminCalcHashFromFileHandle2 WinVerifyTrust CryptCATAdminEnumCatalogFromHash

imm32

ImmSetCandidateWindow ImmAssociateContextEx ImmReleaseContext ImmSetCompositionWindow ImmGetCompositionStringW ImmGetContext

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData CryptProtectData

ole32

RevokeDragDrop CoCreateInstance CoUninitialize RegisterDragDrop OleInitialize CoInitializeEx

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

Name

.text

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

306KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

365KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_e31eb17695c4a63fbf903baaeea67694_akira_glassworm_icedid

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ws2_32

ntdll

opengl32

shlwapi

user32

shell32

gdi32

winmm

fltlib

wintrust

imm32

bcrypt

crypt32

ole32

dwmapi

uxtheme

generic