2026-11-01_a6091ef6e024387605bdcc75265d2c30_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_a6091ef6e024387605bdcc75265d2c30_glassworm_icedid
Size 42.4MB
Sample261102-pxtd1ah131
SHA256 12312b5788acbcb7182c0699d4572c640109be740647f3d128bf9f62d6cb0f55
MD5 a6091ef6e024387605bdcc75265d2c30
SHA1 27704ff9fe593b48b59766668bf0a1fd6220ee3e
SHA512 f62eadf961f96ac2661385bda5d7211614a68e365f5e6bd740f51390b6e08dbabb155ee77cfa3da522fcc514b25d91d6a1f87ff3357a4fa3b4029528e4853034
SSDEEP 393216:+7j6TiDTPLokEeGOQ3NoxxSp8hi7T2Vuo+Z:YjCiDTzWAhieuo+Z
TLSH
T1E5A72825BB5A996DC49AC4B083478A675A3134CB0B35A9FF01C492783F7EBF45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_a6091ef6e024387605bdcc75265d2c30_glassworm_icedid

File Explorer

2026-11-01_a6091ef6e024387605bdcc75265d2c30_glassworm_icedid

.exe 42.4MB

2026-11-01_a6091ef6e024387605bdcc75265d2c30_glassworm_icedid

IMPHASH 9ec2959d15db29feeac6d632db5c85d1
SHA256 12312b5788acbcb7182c0699d4572c640109be740647f3d128bf9f62d6cb0f55
MD5 a6091ef6e024387605bdcc75265d2c30
SHA1 27704ff9fe593b48b59766668bf0a1fd6220ee3e
SHA512 f62eadf961f96ac2661385bda5d7211614a68e365f5e6bd740f51390b6e08dbabb155ee77cfa3da522fcc514b25d91d6a1f87ff3357a4fa3b4029528e4853034
SSDEEP 393216:+7j6TiDTPLokEeGOQ3NoxxSp8hi7T2Vuo+Z:YjCiDTzWAhieuo+Z
TLSH
T1E5A72825BB5A996DC49AC4B083478A675A3134CB0B35A9FF01C492783F7EBF45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30777060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

flexfox-manager.pdb

kernel32

GetStringTypeW GetCPInfo GetOEMCP IsValidCodePage LCMapStringW CompareStringW GetTimeZoneInformation GetCommandLineA FreeLibraryAndExitThread SetStdHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitThread CloseHandle SetFileTime GetSystemTimePreciseAsFileTime WriteFileEx SleepEx ReadFileEx CreateThread CreateHardLinkW GetStdHandle FreeEnvironmentStringsW GetCurrentDirectoryW GetCommandLineW RemoveDirectoryW FindFirstFileExW FindClose LoadLibraryW GetProcAddress ExitProcess SwitchToThread CreateSymbolicLinkW LoadLibraryA DeviceIoControl CreateEventW SetEvent WaitForMultipleObjects GetACP GetDriveTypeW GetFinalPathNameByHandleW GetFileInformationByHandleEx ReplaceFileW CreateDirectoryW CopyFileW GetUserDefaultLocaleName GetNamedPipeClientProcessId SetFileInformationByHandle FlushFileBuffers GetTickCount FormatMessageA GetSystemTime WideCharToMultiByte GetFileSize LockFileEx UnlockFile GetSystemInfo GetNativeSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA ConnectNamedPipe GetFileAttributesW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW ReadFile AreFileApisANSI RaiseException FlsFree FlsAlloc FlsSetValue IsThreadAFiber GetFileType FindNextFileW MoveFileExW GetSystemTimeAsFileTime GetEnvironmentVariableW GetWindowsDirectoryW DeleteCriticalSection SetEnvironmentVariableW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCurrentProcessId GetCurrentThreadId LockResource LoadResource SizeofResource CreateNamedPipeW FindResourceW GetModuleFileNameW CreateProcessW SetHandleInformation ReadConsoleW WriteConsoleW GetSystemDirectoryW DuplicateHandle VirtualProtect ProcessIdToSessionId GlobalSize GetConsoleOutputCP GetUserPreferredUILanguages GetProcessId CreateIoCompletionPort SetFileCompletionNotificationModes GetOverlappedResult PostQueuedCompletionStatus CancelIoEx GetQueuedCompletionStatusEx TerminateProcess GetEnvironmentStringsW GlobalFree CancelIo GetFileInformationByHandle GetConsoleMode SetFilePointerEx AddVectoredExceptionHandler GetModuleHandleExW QueryPerformanceFrequency SetWaitableTimer PowerSetRequest PowerCreateRequest PowerClearRequest GetCurrentPackageFullName GetProcessTimes QueryFullProcessImageNameW GetExitCodeProcess WaitForSingleObject CreateWaitableTimerExW SetNamedPipeHandleState GlobalUnlock GlobalLock GlobalAlloc HeapCreate HeapValidate HeapSize FlushViewOfFile HeapReAlloc OpenProcess HeapCompact HeapDestroy CloseThreadpoolTimer GetModuleHandleA CreateFileMappingW MultiByteToWideChar QueryPerformanceCounter GetLastError CreateThreadpoolTimer SetThreadpoolTimer TrySubmitThreadpoolCallback SetLastError GetCurrentProcess GetCurrentThread SetThreadPriority TerminateJobObject CreateFileW FileTimeToSystemTime OpenJobObjectW QueryInformationJobObject SetInformationJobObject CreateJobObjectW LocaleNameToLCID AssignProcessToJobObject CreateMutexW CompareStringOrdinal Process32NextW Process32FirstW LoadLibraryExW FreeLibrary LoadLibraryExA SetThreadStackGuarantee GetLocalTime GetBinaryTypeW GetTimeZoneInformationForYear SystemTimeToFileTime SystemTimeToTzSpecificLocalTime ReleaseMutex CreateMutexA RtlLookupFunctionEntry RtlCaptureContext HeapFree RtlVirtualUnwind LocalFree UnmapViewOfFile MapViewOfFile GetModuleHandleW CreateToolhelp32Snapshot HeapAlloc lstrlenW TryEnterCriticalSection GetProcessHeap PeekNamedPipe Sleep

advapi32

RegOverridePredefKey GetTokenInformation LookupAccountNameW ConvertSidToStringSidW RegOpenKeyExW RegFlushKey RegGetValueW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityInfo OpenProcessToken CredReadW CredFree CredWriteW CredDeleteW RegCloseKey RegQueryValueExW RegSetValueExW RegCreateKeyTransactedW RegOpenKeyTransactedW GetAce RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumValueW SystemFunction036

ws2_32

accept WSASend ioctlsocket connect recv send getpeername getaddrinfo closesocket getsockopt bind listen WSASocketW setsockopt WSAIoctl WSAGetLastError WSACleanup WSAStartup getsockname freeaddrinfo select shutdown

shell32

DragQueryFileW SHCreateItemFromParsingName ShellExecuteW SHGetKnownFolderPath SHGetStockIconInfo Shell_NotifyIconGetRect SHOpenFolderAndSelectItems SetCurrentProcessExplicitAppUserModelID Shell_NotifyIconW SHGetDesktopFolder

combase

CoIncrementMTAUsage CoTaskMemFree CoCreateFreeThreadedMarshaler

user32

OpenClipboard EmptyClipboard CountClipboardFormats EnumClipboardFormats GetClipboardData IsWindowEnabled GetClipboardFormatNameW RegisterClipboardFormatW CloseClipboard SetClipboardData SetCursor RemovePropW SetPropW SetWindowPos FlashWindowEx SendMessageW UnregisterSuspendResumeNotification SetWindowPlacement SetActiveWindow RegisterSuspendResumeNotification SetFocus GetUserObjectInformationW GetProcessWindowStation ScreenToClient GetKeyState ValidateRect GetFocus EnableWindow GetPointerType GetSystemMetricsForDpi IsZoomed ReleaseCapture TrackMouseEvent SetCapture GetMonitorInfoW RegisterClassW CreateWindowExW DestroyWindow MessageBeep GetSystemMetrics GetDoubleClickTime MonitorFromPoint GetWindowThreadProcessId UnregisterClassW SetTimer EnumThreadWindows EnumDisplayMonitors GetMessageW IsIconic GetWindowPlacement ShowWindowAsync EnumDisplaySettingsW SetForegroundWindow IsWindow GetForegroundWindow IsWindowVisible PostMessageW SystemParametersInfoW GetSysColor GetClassNameW SetWindowTextW RedrawWindow KillTimer PeekMessageW GetKeyboardLayoutNameW TranslateMessage GetDpiForWindow DispatchMessageW TrackPopupMenuEx SendMessageTimeoutW VkKeyScanW IsProcessDPIAware MonitorFromWindow DrawTextW FillRect GetWindowDC OffsetRect SetWindowLongPtrW GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetWindowLongPtrW MessageBoxW DestroyMenu SendInput ShowWindow GetActiveWindow ClientToScreen AppendMenuW InsertMenuW MapVirtualKeyW SetMenuItemInfoW CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu DrawMenuBar SetMenu DefWindowProcW PostQuitMessage CreateAcceleratorTableW GetMenuItemInfoW DestroyAcceleratorTable SystemParametersInfoA DrawIconEx ReleaseDC GetDC CreateIcon RegisterWindowMessageA GetCursorPos ChangeWindowMessageFilterEx TrackPopupMenu GetKeyboardState LoadImageW DestroyIcon ToUnicode FindWindowW AllowSetForegroundWindow RegisterWindowMessageW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ole32

CoUninitialize CoCreateInstance ReleaseStgMedium CoInitializeEx RegisterDragDrop PropVariantClear RevokeDragDrop OleUninitialize OleInitialize CreateStreamOnHGlobal

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

shlwapi

SHCreateMemStream

bcryptprimitives

ProcessPrng

gdi32

DeleteObject CreateSolidBrush SetBkMode SetTextColor CreateCompatibleDC DeleteDC CreateDIBSection GetDeviceCaps SelectObject

crypt32

CertSetCertificateContextProperty CertFreeCertificateChain CertAddEncodedCertificateToStore CertOpenStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFreeCertificateContext

bcrypt

BCryptGenRandom

ntdll

NtOpenFile NtCancelIoFileEx NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError RtlGetVersion NtCreateFile NtWriteFile NtDeviceIoControlFile

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

icuuc

u_strlen

uiautomationcore

UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaLookupId UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaGetReservedMixedAttributeValue UiaRaiseAutomationPropertyChangedEvent

oleaut32

SysAllocStringLen SafeArrayCreateVector SafeArrayPutElement SysFreeString VariantClear SetErrorInfo SysStringLen GetErrorInfo

iphlpapi

GetTcpTable GetExtendedTcpTable

rstrtmgr

RmEndSession RmGetList RmStartSession RmRegisterResources

dcomp

DCompositionCreateDevice

dwmapi

DwmSetWindowAttribute DwmFlush DwmGetCompositionTimingInfo

dwrite

DWriteCreateFactory

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmAssociateContextEx ImmGetContext ImmNotifyIME ImmGetCompositionStringW ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

gdiplus

GdipCreateBitmapFromStream GdiplusStartup GdipGetImageThumbnail GdipDisposeImage GdipCreateHBITMAPFromBitmap GdiplusShutdown

userenv

GetUserProfileDirectoryW

Name

.text

Size

29.8MB

Virtual Size

29.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

292KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_a6091ef6e024387605bdcc75265d2c30_glassworm_icedid

kernel32

advapi32

ws2_32

shell32

combase

user32

api-ms-win-core-synch-l1-2-0

ole32

version

comctl32

shlwapi

bcryptprimitives

gdi32

crypt32

bcrypt

ntdll

api-ms-win-shcore-scaling-l1-1-1

icuuc

uiautomationcore

oleaut32

iphlpapi

rstrtmgr

dcomp

dwmapi

dwrite

winmm

imm32

dxgi

d3d11

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

gdiplus

userenv

generic