Skip to main content

GlassWorm

Malware Family

243 indicators of compromise attributed to GlassWorm across abuse.ch threat intelligence feeds.

Domains

0

IPs

17

URLs

114

Hashes

112

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
217.69.2.135ip
45.32.150.251ip
45.150.34.158ip
108.61.177.82ip
199.247.10.166ip
45.76.45.151ip
70.34.242.255ip
217.69.11.60ip
45.32.151.157ip
217.69.11.57ip
45.32.150.97ip
45.76.44.240ip
217.69.3.152ip
217.69.3.51ip
217.69.0.159ip
217.69.11.99ip
208.85.20.124ip
http://45.32.150.251/get_arhive_npm/NbYBPxIy9ZbwhalNq5L9KA%3D%3Durl
http://217.69.0.159/xDMjY1UOOHWPpfDdc1OY1w%3D%3Durl
http://217.69.3.51/NrIgZ6I%2BFyCxXHb%2B9FapRg%3D%3Durl
http://45.32.150.251/darwin-universal/Lm8NJsV%2BCj5VQM2fKlZmng%3D%3D?wallet=trezorurl
http://45.32.150.251/g/1Y4WLrpIxyti%2FGLsMk%2FG5A%3D%3Durl
http://217.69.0.159/dq1IMEteQ4AbO3daeYGXZw%3D%3Durl
http://45.32.150.251/niJjiverQDmWmCuyRWx4hQ%3D%3Durl
http://217.69.3.51/darwin-universal/1%2FtD%2F6d9ykFdWb6axInO%2Bg%3D%3D?wallet=trezorurl
http://217.69.2.135/get_arhive_npm/gXsONK0cYBWd7YuhpXcg0Q%3D%3Durl
http://45.32.150.251/CuSix1P76JsOJIk7kBp9Sg%3D%3Durl
http://217.69.3.51/lzgWdJKan%2FG2wWN78uuGzg%3D%3Durl
http://217.69.3.51/K6iopyYvkyPx6R2fd5c6%2Fg%3D%3Durl
https://go.getblock.us/86aac42ad4484f3c813079afc201451curl
http://217.69.3.51/g/lzgWdJKan%2FG2wWN78uuGzg%3D%3Durl
http://217.69.2.135/darwin-universal/olPDwN6o4fVo56us9X3T%2Fw%3D%3D?wallet=ledgerurl
http://217.69.11.99/module/wrtcurl
http://45.32.150.251/get_arhive_npm/TF3wpi1E5Y1y%2B6LY7%2FZj5g%3D%3Durl
http://45.32.150.251/get_arhive_npm/qDiJ1Z4akTFClzs540AXfA%3D%3Durl
http://217.69.3.51/lYc8y7qfNjkARpt8FxAZsw%3D%3Durl
http://217.69.2.135/CZW8qtpLZObJpuSkaGebRA%3D%3Durl
b9406f9490c3faddc109eca46d2781925a3b9bc9e04488e48013d29fd0e1f1b8hash
50a891fe72f61b91bca13326f7b334437054fe8e6d6620665c3d47b0118c7792hash
8af226c0aa71fefe5228e881f4b5c5d90a8b41c290b96f44f56990d8dc3fac1chash
664408e2c14cbf4ad1eeea0d7bb65593e612527bacc7b814b00b2f0a445a6cbahash
c7ab7cd59325272f114aa5f77c1cd0efe0e7d93a5bd7414c0faff9d7c9f2e38bhash
9531d9ddd44f9b7834e54994ee0c9332f76f324f17e1f02056afc0a8c5628408hash
e56dfb687fc9f6a16be92701c162a21fde4d8647e583e64f953435e2fc90d67fhash
df3c034de5ecd4c24798bb8f83e20628eccfc6819ed1611ac6f7576bbc0d3bbfhash
db88feb7d333429e19f482ab28d95a8bfcb2aa1d9949f549f6da58feb3d033e5hash
e97e50b6e104fdbcd2dc33cfe3cbb50df9a1fe28326af6d507260b4cb741799fhash
49cd8c05959153106d9a7472cd1042310ad7825eb1260ec155ff906315012634hash
d02db967b9ccf083bb79b10216dd5bd150c6dddcad477b95b3fe5dde0ed7e009hash
3cc0a9e9f064486bf063e69be03ca65557d8182d2975185d44677b66814cdaa2hash
868938755dbacc4480a5395f12ae9c8467d735cd06bc69b608c84ea5becd40cfhash
06fab21dc276e3ab9b5d0a1532398979fd377b080c86d74f2c53a04603a43b1dhash
41caca39e0605527f6124e18902b8719131b1e13531fa5b71da4020ea6b9e1a7hash
bb68992f6aa2d3f316322e88d9e71491a38e95fd3a27f48084c66b9c210bd17dhash
68e5fb92a7d7d182306a025010c77ae2cd89c39031cced13f9686a9f34671041hash
731c63cfd9a540a588737de5cf7fb8261e4fef7bc7a9b69fe32afee28932e940hash
45552a3670e52f13df24b403a8d450b592b556bea9e3343e7d38cd3e0921743dhash

Another file to check? Run a file hash reputation check.