2026-10-21_7e8ac5a38117dafa9d26ee1faee7c640_glassworm_icedid_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_7e8ac5a38117dafa9d26ee1faee7c640_glassworm_icedid_poet-rat
Size 17.5MB
Sample261022-ynxjqsbd77
SHA256 b566b7d630aa0d75315cc10bf358ee3b5d0097601bb0872412f3ae640e706283
MD5 7e8ac5a38117dafa9d26ee1faee7c640
SHA1 42ea301e4603663aefc2e466221911cafa962db7
SHA512 63aec4c0e18fcd474fd3b29376cc7bdf41975ed78f57110ce14c5803a58b8304dfe33944f60a0d8301d1fcfaf56b016307bc856bfce770c7969e3c30dacf9f36
SSDEEP 98304:cLQ64icKbEhatW64aUyZ9guHbAj4SDwRBm+ZUHacGdPMBNf9n:oLIc4a7SUREwUV3
TLSH
T1140718157B9E94A9D15AC8B0834B4A734A3074CB1B36B9FF44C491792FAEAF41B3D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_7e8ac5a38117dafa9d26ee1faee7c640_glassworm_icedid_poet-rat

File Explorer

2026-10-21_7e8ac5a38117dafa9d26ee1faee7c640_glassworm_icedid_poet-rat

.exe 17.5MB

2026-10-21_7e8ac5a38117dafa9d26ee1faee7c640_glassworm_icedid_poet-rat

IMPHASH 58469f0348a0643710ace485d6d3d2e6
SHA256 b566b7d630aa0d75315cc10bf358ee3b5d0097601bb0872412f3ae640e706283
MD5 7e8ac5a38117dafa9d26ee1faee7c640
SHA1 42ea301e4603663aefc2e466221911cafa962db7
SHA512 63aec4c0e18fcd474fd3b29376cc7bdf41975ed78f57110ce14c5803a58b8304dfe33944f60a0d8301d1fcfaf56b016307bc856bfce770c7969e3c30dacf9f36
SSDEEP 98304:cLQ64icKbEhatW64aUyZ9guHbAj4SDwRBm+ZUHacGdPMBNf9n:oLIc4a7SUREwUV3
TLSH
T1140718157B9E94A9D15AC8B0834B4A734A3074CB1B36B9FF44C491792FAEAF41B3D318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13068764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stratforge.pdb

ws2_32

send bind getsockopt listen recv shutdown getpeername setsockopt WSAIoctl WSASocketW connect ioctlsocket WSASend WSAGetLastError getsockname accept closesocket WSACleanup freeaddrinfo getaddrinfo WSAStartup select

kernel32

GetQueuedCompletionStatusEx DuplicateHandle IsProcessInJob OpenProcess GetExitCodeProcess GetLastError TerminateProcess WaitForSingleObject GetQueuedCompletionStatus CreateJobObjectW SetHandleInformation CreateIoCompletionPort SetInformationJobObject AssignProcessToJobObject QueryInformationJobObject TerminateJobObject LockFileEx GlobalMemoryStatusEx CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStdHandle GetConsoleMode SetConsoleMode SetStdHandle FlsGetValue ExitThread SetConsoleCtrlHandler GetCurrentThreadId ReadFile GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile SetFilePointer PostQueuedCompletionStatus SetEndOfFile GetTempPathW CreateMutexW CreateFileW GetFileAttributesW Sleep GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW GetNativeSystemInfo GetSystemInfo UnlockFile LocalFree GetFileSize GetCurrentProcessId FreeLibrary GetSystemTimeAsFileTime GetSystemTime GetTickCount FlushFileBuffers SetConsoleTextAttribute GetConsoleScreenBufferInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetProcessTimes SetFileCompletionNotificationModes GetCurrentProcess UnlockFileEx CloseHandle GetFullPathNameA AreFileApisANSI IsProcessorFeaturePresent GetStartupInfoW GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetTimeZoneInformation GetCommandLineA FreeLibraryAndExitThread LoadLibraryExW InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader RtlUnwindEx IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW QueryPerformanceFrequency GetModuleHandleA GetFileType IsThreadAFiber FlsSetValue GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW ReadConsoleW GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA GetStringTypeW ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetEnvironmentStringsW GetProcessId CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext WriteFileEx SleepEx ReadFileEx CreateThread SetFileInformationByHandle MoveFileExW SetLastError FreeEnvironmentStringsW CompareStringOrdinal DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate HeapFree OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar OutputDebugStringW FlushViewOfFile LoadLibraryA SwitchToThread FormatMessageW RtlVirtualUnwind QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA WideCharToMultiByte GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetProcAddress HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

psapi

GetProcessMemoryInfo

ntdll

NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

547KB

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_7e8ac5a38117dafa9d26ee1faee7c640_glassworm_icedid_poet-rat

ws2_32

kernel32

api-ms-win-core-synch-l1-2-0

psapi

ntdll

bcryptprimitives

bcrypt

advapi32

generic