2026-10-26_f58d1bf306f2425e37b4e2c802c7b307_glassworm_icedid_poet-rat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f58d1bf306f2425e37b4e2c802c7b307_glassworm_icedid_poet-rat_stealc_vidar
Size 10.6MB
Sample261027-cf8fdaz1et
SHA256 62ca00a2b88ffa6f57b607631e8870d78e8b0dce170914f3133babcebb0f1903
MD5 f58d1bf306f2425e37b4e2c802c7b307
SHA1 dbdb1ec69befd519a0c8d1511260d5869ad7dda3
SHA512 55afea9894b13b43d937429baa739d5c1cf2d6a93da7602af2d87b9ae2ac3646e378a655eadada3da80211c7511f50920ac81ee98e50badf01f6e68ccebc30e6
SSDEEP 98304:H0ZCCCCCC82fjVb5gv39mhe5KUFXBGYUbdgGd+ORSjiZROkN8+2V6/txjM46ZoeC:C5g8I550YIdgGwORSjOO1PV6VxjM4U+
TLSH
T1AFB67D42B3A58511C4676F3589369BE48332BC16FF1BD35A340CBA1A3FB32C15A657E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_f58d1bf306f2425e37b4e2c802c7b307_glassworm_icedid_poet-rat_stealc_vidar

.exe 10.6MB

2026-10-26_f58d1bf306f2425e37b4e2c802c7b307_glassworm_icedid_poet-rat_stealc_vidar

IMPHASH 53e4e12437621212a425d294842d0a96
SHA256 62ca00a2b88ffa6f57b607631e8870d78e8b0dce170914f3133babcebb0f1903
MD5 f58d1bf306f2425e37b4e2c802c7b307
SHA1 dbdb1ec69befd519a0c8d1511260d5869ad7dda3
SHA512 55afea9894b13b43d937429baa739d5c1cf2d6a93da7602af2d87b9ae2ac3646e378a655eadada3da80211c7511f50920ac81ee98e50badf01f6e68ccebc30e6
SSDEEP 98304:H0ZCCCCCC82fjVb5gv39mhe5KUFXBGYUbdgGd+ORSjiZROkN8+2V6/txjM46ZoeC:C5g8I550YIdgGwORSjOO1PV6VxjM4U+
TLSH
T1AFB67D42B3A58511C4676F3589369BE48332BC16FF1BD35A340CBA1A3FB32C15A657E2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ad:96:1e:1f:3a:b5:f9:64:ae:6f:31:1c:f2:9b:4c:2f:1f:64:49:ef:4f:c5:fd:9c:73:c6:f5:f1:40:9e:64:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Simon Fearby,O=Simon Fearby,L=Tamworth,ST=New South Wales,C=AU

Chains

Oct 25, 2026

CN=Simon Fearby,O=Simon Fearby,L=Tamworth,ST=New South Wales,C=AU

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Simon Fearby,O=Simon Fearby,L=Tamworth,ST=New South Wales,C=AU

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Simon Fearby,O=Simon Fearby,L=Tamworth,ST=New South Wales,C=AU

Serial Number

06:4c:26:f7:21:57:0a:fa:c2:03:1b:ea:d9:22:f7:5d

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 3, 2026 - Sep 3, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

80800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose GetFileAttributesW MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW GetCurrentProcessId TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f58d1bf306f2425e37b4e2c802c7b307_glassworm_icedid_poet-rat_stealc_vidar

shell32

advapi32

kernel32

user32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

generic