2026-10-02_f86ae478f9f2480e802677cf08c7cba6_glassworm_icedid_megazord_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_f86ae478f9f2480e802677cf08c7cba6_glassworm_icedid_megazord_ryuk
Size 8.6MB
Sample261002-12t2watgnc
SHA256 25ca60416d5ed9950815b17011f55bee25bce442cc0c51e2da24d33ba707d79d
MD5 f86ae478f9f2480e802677cf08c7cba6
SHA1 8861ffface3993a1f43c8455ac376ab659145271
SHA512 bd9fb9ef79370868f060ac187e7a3fde0f37e22d028c0a42f873943361a7b3d535252887ed1cfceb41cb0b6a65b0dde541a8f8def12f866ce9f64be3bef17c68
SSDEEP 98304:ovEtwW8pHfar93TNMhtI1wUhdw9lqk97MOYGjKiMN5t:PtZqWAtjI5
TLSH
T17E964A12BA5A69ACC15AC47083468A736A3130CA0B35B9FF44D496793F79BF41F3C768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_f86ae478f9f2480e802677cf08c7cba6_glassworm_icedid_megazord_ryuk

File Explorer

2026-10-02_f86ae478f9f2480e802677cf08c7cba6_glassworm_icedid_megazord_ryuk

.exe 8.6MB

2026-10-02_f86ae478f9f2480e802677cf08c7cba6_glassworm_icedid_megazord_ryuk

IMPHASH 56d927059361a314e22256ca8e82cc59
SHA256 25ca60416d5ed9950815b17011f55bee25bce442cc0c51e2da24d33ba707d79d
MD5 f86ae478f9f2480e802677cf08c7cba6
SHA1 8861ffface3993a1f43c8455ac376ab659145271
SHA512 bd9fb9ef79370868f060ac187e7a3fde0f37e22d028c0a42f873943361a7b3d535252887ed1cfceb41cb0b6a65b0dde541a8f8def12f866ce9f64be3bef17c68
SSDEEP 98304:ovEtwW8pHfar93TNMhtI1wUhdw9lqk97MOYGjKiMN5t:PtZqWAtjI5
TLSH
T17E964A12BA5A69ACC15AC47083468A736A3130CA0B35B9FF44D496793F79BF41F3C768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6323120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

relay_client.pdb

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIo CancelIoEx CloseHandle CompareStringOrdinal CompareStringW CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreatePipe CreateProcessW CreateRemoteThread CreateSemaphoreA CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExA FindFirstFileExW FindFirstVolumeW FindNextFileA FindNextFileW FindNextVolumeW FindVolumeClose FlsAlloc FlsFree FlsSetValue FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathA GetTempPathW GetTickCount GetTimeZoneInformation GetTimeZoneInformationForYear GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsWow64Process2 K32GetPerformanceInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus Process32FirstW Process32NextW QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex ReleaseSemaphore RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetErrorMode SetEvent SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetStdHandle SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UpdateProcThreadAttribute VirtualAllocEx VirtualProtectEx VirtualQueryEx WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx WriteProcessMemory lstrlenW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

combase

CoTaskMemFree

advapi32

AdjustTokenPrivileges CopySid GetLengthSid GetTokenInformation InitiateSystemShutdownExW IsValidSid LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

dxgi

CreateDXGIFactory1

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

shell32

CommandLineToArgvW IsUserAnAdmin SHGetKnownFolderPath ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send setsockopt shutdown

user32

BeginPaint CallNextHookEx CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EndPaint EnumWindows FillRect GetAsyncKeyState GetClientRect GetDC GetKeyboardState GetMessageW GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowLongW GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InvalidateRect IsWindowVisible LoadCursorW MessageBoxW MoveWindow PeekMessageW PostQuitMessage RegisterClassExW RegisterClassW ReleaseDC SendInput SendMessageW SetForegroundWindow SetLayeredWindowAttributes SetProcessDpiAwarenessContext SetWinEventHook SetWindowDisplayAffinity SetWindowLongPtrW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToUnicode TranslateMessage UnhookWinEvent UnhookWindowsHookEx UpdateWindow keybd_event

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

gdi32

CreateCompatibleDC CreateDIBSection CreateFontW CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetStretchBltMode SetTextColor StretchBlt StretchDIBits

winmm

PlaySoundW

iphlpapi

GetAdaptersAddresses

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

mfreadwrite

MFCreateSourceReaderFromMediaSource

mfplat

MFCreateAttributes MFCreateSample MFShutdown MFStartup

mf

MFEnumDeviceSources

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhEnumObjectsA PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_f86ae478f9f2480e802677cf08c7cba6_glassworm_icedid_megazord_ryuk

kernel32

ole32

combase

advapi32

dxgi

secur32

shell32

api-ms-win-core-synch-l1-2-0

ws2_32

user32

crypt32

gdi32

winmm

iphlpapi

bcryptprimitives

ntdll

mfreadwrite

mfplat

mf

oleaut32

pdh

powrprof

psapi

bcrypt

generic