2026-10-10_204fdb20e571c36df710df8305512196_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_204fdb20e571c36df710df8305512196_glassworm_icedid
Size 6.6MB
Sample261011-x4f19act3v
SHA256 ece0baa66131105709159152efb0a026f7f848529490abc78e299258937a3dad
MD5 204fdb20e571c36df710df8305512196
SHA1 4d3425f6270167e46d005e37ed11a42127f2358d
SHA512 501ed1af86927848debd9e5e0380a1b9d2aa1a17daf520a6e8eb299f63fbe90be600527242fbdf30fce9a6a63112e29bb44e9179ee82ab994feac6db23071ad0
SSDEEP 49152:nr5T2cDF+n/FUqFnc1V88holQSzhJkSA2bmbbwXO5WSl06g3vdKDs8sLH+/4BQca:j1m1JkSmzkFKDZwF55mmFev7wRGpj3
TLSH
T1D8664A59B7F481EAC132C13E8992CE56D97D38020B307ACB5D914B1A9E37AD45839B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_204fdb20e571c36df710df8305512196_glassworm_icedid

File Explorer

2026-10-10_204fdb20e571c36df710df8305512196_glassworm_icedid

.exe 6.6MB

2026-10-10_204fdb20e571c36df710df8305512196_glassworm_icedid

IMPHASH 4e2e3770ce482f11d8a16893ad9f0f9c
SHA256 ece0baa66131105709159152efb0a026f7f848529490abc78e299258937a3dad
MD5 204fdb20e571c36df710df8305512196
SHA1 4d3425f6270167e46d005e37ed11a42127f2358d
SHA512 501ed1af86927848debd9e5e0380a1b9d2aa1a17daf520a6e8eb299f63fbe90be600527242fbdf30fce9a6a63112e29bb44e9179ee82ab994feac6db23071ad0
SSDEEP 49152:nr5T2cDF+n/FUqFnc1V88holQSzhJkSA2bmbbwXO5WSl06g3vdKDs8sLH+/4BQca:j1m1JkSmzkFKDZwF55mmFev7wRGpj3
TLSH
T1D8664A59B7F481EAC132C13E8992CE56D97D38020B307ACB5D914B1A9E37AD45839B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1012720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\bamboo-build\CE-MBA-BUILDPC\HWCtrlSupport\build\release\x64\standalone\NIHardwareService.pdb

hid

HidD_GetHidGuid HidD_GetAttributes HidD_GetManufacturerString HidD_GetProductString HidD_GetSerialNumberString HidD_SetFeature HidD_GetFeature HidD_GetInputReport HidD_FreePreparsedData HidD_GetPreparsedData HidP_GetCaps

kernel32

ReadFile WriteFile GetCurrentThreadId GetLastError WaitForMultipleObjects CancelIo GetOverlappedResult CreateFileW CloseHandle ResetEvent TryEnterCriticalSection GetStdHandle CompareStringW GetUserDefaultLangID LockFileEx UnlockFileEx GetProcAddress GetModuleHandleW GetCurrentProcess GetCurrentProcessId QueryPerformanceCounter QueryPerformanceFrequency CreateSemaphoreW ReleaseSemaphore GetCurrentThread SetThreadPriority ResumeThread SleepEx TlsAlloc TlsFree LockResource SizeofResource LoadResource FindResourceA ExitProcess GetFileAttributesExW LocalFree RaiseException FindClose DuplicateHandle OutputDebugStringW WriteConsoleW WriteConsoleA MultiByteToWideChar WideCharToMultiByte GetACP GetFileInformationByHandle GetFileAttributesW DeviceIoControl GetCurrentDirectoryW GetComputerNameW GetSystemInfo GetUserDefaultLCID IsWow64Process CreateDirectoryW GetDriveTypeW GetLogicalDriveStringsW FlushViewOfFile FileTimeToLocalFileTime SetNamedPipeHandleState WaitNamedPipeW CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe GetLocaleInfoA RtlPcToFileHeader TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx HeapFree GetCommandLineA GetStartupInfoA GetSystemTimeAsFileTime HeapAlloc SetStdHandle GetFileType ExitThread CreateThread FileTimeToSystemTime LCMapStringA LCMapStringW GetCPInfo GetStringTypeW CompareStringA GetModuleFileNameA EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc HeapSetInformation HeapCreate HeapSize GetOEMCP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetTickCount GetTimeZoneInformation FatalAppExitA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetFilePointer FlushFileBuffers HeapReAlloc GetStringTypeA EnumSystemLocalesA IsValidLocale LoadLibraryA GetLocaleInfoW FreeLibrary GetConsoleOutputCP SetEnvironmentVariableA SetEnvironmentVariableW CreateFileA SetEndOfFile GetProcessHeap IsDBCSLeadByteEx GetVersionExA GetFileSize GetCurrentDirectoryA GetFullPathNameA GetFullPathNameW lstrlenA GetVersionExW InitializeCriticalSection DeleteCriticalSection CreateEventW WaitForSingleObject Sleep GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetEvent FindFirstFileW DeleteFileA

user32

MessageBoxA DestroyWindow UnregisterClassW CharUpperBuffW CharLowerBuffW DefWindowProcW MessageBoxW RegisterClassW CreateWindowExW RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

RegEnumKeyExA GetNamedSecurityInfoW RegQueryValueExW RegSetValueExW GetTokenInformation StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW OpenServiceW ControlService QueryServiceStatus DeleteService OpenSCManagerW CreateServiceW ChangeServiceConfig2W StartServiceW RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegFlushKey CreateWellKnownSid SetNamedSecurityInfoW SetEntriesInAclW InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken SetServiceStatus CloseServiceHandle

ole32

CoCreateInstance StringFromGUID2 CLSIDFromString CoUninitialize CoInitialize OleInitialize CoGetObject OleUninitialize

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

version

VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW

dbghelp

MiniDumpWriteDump

shell32

SHGetFolderPathW

oleaut32

SysFreeString VariantClear SysAllocString

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

281KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

627KB

Virtual Size

627KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_204fdb20e571c36df710df8305512196_glassworm_icedid

hid

kernel32

user32

advapi32

ole32

setupapi

version

dbghelp

shell32

oleaut32

generic