2026-10-01_7b972ef077530ddc3e0425a2320ff5ee_cobalt-strike_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_7b972ef077530ddc3e0425a2320ff5ee_cobalt-strike_glassworm_icedid
Size 720KB
Sample261002-m4sd6sha84
SHA256 ad475fc0a3bbfcc576f62690cbc685b9c0d0974d88b74167e0cb55d170b82f4a
MD5 7b972ef077530ddc3e0425a2320ff5ee
SHA1 662afe3fa10030566b9ac8a08e553fce3d1b6412
SHA512 1dec8038ee483cfbd25e9278c31862dfef113760f921b764a5301905ad3f22ceb37e68accdb67998384440f4513d0b8a96589d9f066d1bbf218400b701b1a18b
SSDEEP 6144:Oj5GGRdJ7E5FOgJQ+pJKu9pRLRHR+Ah2YQZJOBl2oyTmvsrbZ3VUHx1SkBgkQti9:pedJk1JfZBh2XCL2oyT7bbkBEGx5
TLSH
T184F48D13EEA201F8D026C076875B5166F671B8470321ADFB369C52383FA6AF15B3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_7b972ef077530ddc3e0425a2320ff5ee_cobalt-strike_glassworm_icedid

File Explorer

2026-10-01_7b972ef077530ddc3e0425a2320ff5ee_cobalt-strike_glassworm_icedid

.exe 720KB

2026-10-01_7b972ef077530ddc3e0425a2320ff5ee_cobalt-strike_glassworm_icedid

IMPHASH 7da9b44b0759c68c79f6f6044a677291
SHA256 ad475fc0a3bbfcc576f62690cbc685b9c0d0974d88b74167e0cb55d170b82f4a
MD5 7b972ef077530ddc3e0425a2320ff5ee
SHA1 662afe3fa10030566b9ac8a08e553fce3d1b6412
SHA512 1dec8038ee483cfbd25e9278c31862dfef113760f921b764a5301905ad3f22ceb37e68accdb67998384440f4513d0b8a96589d9f066d1bbf218400b701b1a18b
SSDEEP 6144:Oj5GGRdJ7E5FOgJQ+pJKu9pRLRHR+Ah2YQZJOBl2oyTmvsrbZ3VUHx1SkBgkQti9:pedJk1JfZBh2XCL2oyT7bbkBEGx5
TLSH
T184F48D13EEA201F8D026C076875B5166F671B8470321ADFB369C52383FA6AF15B3E764
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

alexlootlink.pdb

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

kernel32

SwitchToThread GetLastError GetProcessHeap HeapFree HeapAlloc FormatMessageW FreeLibrary LoadLibraryW CloseHandle LoadLibraryExW GetModuleHandleA GetModuleFileNameW IsThreadAFiber LoadLibraryExA FlsFree FlsGetValue FlsAlloc MultiByteToWideChar WideCharToMultiByte ReleaseMutex GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx GetCurrentProcess GetCurrentThreadId GetCurrentThread SetThreadStackGuarantee GetStringTypeW CreateToolhelp32Snapshot Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW GetModuleHandleExW SetLastError WaitForSingleObject GetCPInfo GetModuleHandleW GetOEMCP EncodePointer LCMapStringW FlsSetValue GetACP IsValidCodePage ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW IsProcessorFeaturePresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess CompareStringW InitializeCriticalSectionEx GetFileType SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA WriteFile InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime OutputDebugStringW OutputDebugStringA GetFileAttributesW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileTime CreateFileW GetFullPathNameW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind CreateMutexA RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW AddVectoredExceptionHandler HeapReAlloc SetFileInformationByHandle MoveFileExW CreateThread FindClose FindNextFileW VirtualProtect HeapSize FlushFileBuffers SetFilePointerEx GetTempPathW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ole32

CoInitializeEx CoCreateInstance

shlwapi

SHCreateMemStream

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree RoGetAgileReference CoTaskMemAlloc

user32

MonitorFromRect PostQuitMessage DestroyWindow DefWindowProcW SetWindowPos GetDpiForWindow IsIconic IsZoomed GetWindowPlacement CreateWindowExW ShowWindow IsWindow GetMessageW TranslateMessage SystemParametersInfoW DispatchMessageW GetClientRect MessageBoxW GetDpiForSystem PostMessageW GetMessageA DispatchMessageA RegisterClassExW LoadImageW SetWindowPlacement GetSystemMetrics LoadCursorW

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

gdi32

CreateSolidBrush

dwmapi

DwmSetWindowAttribute

bcryptprimitives

ProcessPrng

advapi32

EventSetInformation EventWriteTransfer EventUnregister RegOpenKeyExW RegQueryValueExW RegCloseKey RegGetValueW EventRegister

Name

.text

Size

399KB

Virtual Size

398KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

279KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_7b972ef077530ddc3e0425a2320ff5ee_cobalt-strike_glassworm_icedid

oleaut32

kernel32

api-ms-win-core-synch-l1-2-0

ole32

shlwapi

combase

user32

shell32

api-ms-win-core-winrt-error-l1-1-0

ntdll

gdi32

dwmapi

bcryptprimitives

advapi32

generic