2026-10-22_95fb30013522165ee1bfd30aae33cd38_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_95fb30013522165ee1bfd30aae33cd38_glassworm_icedid
Size 3.6MB
Sample261024-emy7dsfw8t
SHA256 297ebc6b5f8c3e104508bfdbfd9ef958217861155ae9621ffd89a7abcfbbc49b
MD5 95fb30013522165ee1bfd30aae33cd38
SHA1 8e187dc19d226f46fdfd6596ed648edac9318f48
SHA512 b5b38f888e9ed7c00809854ad8b062f0aec3115c422ecb9d01e11fe9dac4cec8f83ace5de4224402843c3c79db0b694ef583f1561641591e003a24fa6d4c70e4
SSDEEP 98304:FIHB4qBf28/Bo02KcLydwZWrYp6PQGBrH+YIleHu:OsAKZLKfrVIll
TLSH
T148066C52F25290F9C129C174D749A633BA727C894B3436FB5694BB223F71B906E3EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_95fb30013522165ee1bfd30aae33cd38_glassworm_icedid

File Explorer

2026-10-22_95fb30013522165ee1bfd30aae33cd38_glassworm_icedid

.exe 3.6MB

2026-10-22_95fb30013522165ee1bfd30aae33cd38_glassworm_icedid

IMPHASH f38efdabff45515848d19897c7062092
SHA256 297ebc6b5f8c3e104508bfdbfd9ef958217861155ae9621ffd89a7abcfbbc49b
MD5 95fb30013522165ee1bfd30aae33cd38
SHA1 8e187dc19d226f46fdfd6596ed648edac9318f48
SHA512 b5b38f888e9ed7c00809854ad8b062f0aec3115c422ecb9d01e11fe9dac4cec8f83ace5de4224402843c3c79db0b694ef583f1561641591e003a24fa6d4c70e4
SSDEEP 98304:FIHB4qBf28/Bo02KcLydwZWrYp6PQGBrH+YIleHu:OsAKZLKfrVIll
TLSH
T148066C52F25290F9C129C174D749A633BA727C894B3436FB5694BB223F71B906E3EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2358768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aresrs.pdb

ntdll

NtCreateNamedPipeFile NtQueryVolumeInformationFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtWriteFile RtlGetVersion NtOpenFile NtQueryInformationProcess RtlNtStatusToDosError RtlUnwindEx RtlPcToFileHeader NtReadFile

kernel32

GetProcessHeap SetFilePointerEx SetLastError HeapFree FreeConsole GetStdHandle WaitForSingleObject GetSystemTimePreciseAsFileTime AddVectoredExceptionHandler CreateThread RemoveVectoredExceptionHandler FindClose GetProcessTimes FreeLibrary FindNextFileW SetConsoleTitleW AllocConsole DeleteFileW GetTempPathW DuplicateHandle QueryProcessCycleTime CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW CreateDirectoryW GetTickCount64 ReadConsoleW HeapReAlloc GetModuleHandleExW GetModuleFileNameW FindFirstFileExW GetLastError CloseHandle SetStdHandle OpenProcess QueryFullProcessImageNameW HeapSize VirtualProtect SetFileTime GetProcessId GetExitCodeProcess TerminateProcess GetModuleHandleA GetProcAddress Thread32First Thread32Next GetProcessIoCounters SuspendThread FlsGetValue GetFileInformationByHandleEx WriteFile LoadLibraryExW TlsFree TlsSetValue ReadProcessMemory TlsGetValue GetTimeZoneInformationForYear TlsAlloc SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetModuleHandleW FormatMessageW HeapAlloc FlsAlloc IsThreadAFiber FlsSetValue FlsFree CreateFileW SleepEx ReadFileEx WriteFileEx InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException ExitProcess GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW CreateWaitableTimerExW SetWaitableTimer Sleep EncodePointer IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetCurrentProcess LoadLibraryExA SetFileInformationByHandle GetFullPathNameW GetSystemTimeAsFileTime GetCurrentProcessId OpenThread GetConsoleMode SwitchToThread GetConsoleOutputCP FlushFileBuffers GetFileType SetHandleInformation GetFileInformationByHandle InitializeCriticalSectionEx WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceFrequency GetEnvironmentVariableW MultiByteToWideChar WideCharToMultiByte lstrlenW GetCurrentDirectoryW LCMapStringW QueryPerformanceCounter SetCurrentDirectoryW GetCommandLineW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetStringTypeW CompareStringW GetCommandLineA

advapi32

RegDeleteValueW OpenTraceW ProcessTrace CloseTrace RegQueryValueExW CreateWellKnownSid EnableTraceEx2 StartTraceW RegEnumKeyExW RegQueryInfoKeyW CheckTokenMembership ControlTraceW RegEnumValueW RegOpenKeyExW RegCloseKey RegSetValueExW SystemFunction036

oleaut32

SysStringLen SysAllocStringLen SetErrorInfo GetErrorInfo SysFreeString VariantClear

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

psapi

GetProcessMemoryInfo EmptyWorkingSet

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom

user32

IsWindowVisible MessageBoxW EnumWindows GetWindowTextW GetWindowThreadProcessId

combase

CoTaskMemFree CoIncrementMTAUsage CoCreateFreeThreadedMarshaler

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

iphlpapi

GetAdaptersAddresses

shell32

SHGetKnownFolderPath SHQueryUserNotificationState

tdh

TdhGetProperty TdhGetPropertySize

wlanapi

WlanQueryInterface WlanCloseHandle WlanFreeMemory WlanEnumInterfaces WlanOpenHandle

ws2_32

WSAGetLastError closesocket getsockopt WSAStartup getaddrinfo freeaddrinfo ioctlsocket connect select setsockopt recv send getpeername WSASocketW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

654KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

528KB

Virtual Size

527KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_95fb30013522165ee1bfd30aae33cd38_glassworm_icedid

ntdll

kernel32

advapi32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

psapi

bcrypt

user32

combase

ole32

iphlpapi

shell32

tdh

wlanapi

ws2_32

api-ms-win-core-winrt-l1-1-0

generic