Skip to main content

GlassWorm

Malware Family

243 indicators of compromise attributed to GlassWorm across abuse.ch threat intelligence feeds.

Domains

0

IPs

17

URLs

114

Hashes

112

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

IPs (17)URLs (114)Hashes (112)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
217.69.2.135ip
45.32.150.251ip
45.150.34.158ip
108.61.177.82ip
199.247.10.166ip
45.76.45.151ip
70.34.242.255ip
217.69.11.60ip
45.32.151.157ip
217.69.11.57ip
45.32.150.97ip
45.76.44.240ip
217.69.3.152ip
217.69.3.51ip
217.69.0.159ip
217.69.11.99ip
208.85.20.124ip
http://217.69.8.40/63RbXCmTBoPZhfyuqUsNdA%3D%3Durl
http://217.69.0.159/xDMjY1UOOHWPpfDdc1OY1w%3D%3Durl
http://45.32.150.251/M%2F7UsvZ%2F5IgfbDBlNPcXwA%3D%3Durl
http://45.32.150.251/darwin-universal/Lm8NJsV%2BCj5VQM2fKlZmng%3D%3D?wallet=trezorurl
http://45.32.150.251/wBienbSMCQVw7hVbXv2RZg%3D%3Durl
http://217.69.0.159/get_arhive_npm/CaZPVvNsQfLDx9O6QbxOnw==url
http://45.32.150.251/g/1Y4WLrpIxyti%2FGLsMk%2FG5A%3D%3Durl
https://calendar.app.google/CcqGmLkERzV6kDa28url
http://217.69.2.135/get_arhive_npm/nOquvjRpCd%2FsADyFqeGQtQ%3D%3Durl
http://217.69.0.159:4789/socket.io/url
http://217.69.3.51/get_arhive_npm/LMTNiVUlATw34RQi2jrf1Q%3D%3Durl
http://217.69.11.99/q6AUyyAAatxzpCw2im8XFg%3D%3Durl
http://45.32.150.251/L9U0rBKRgjy0qqieRebNAw%3D%3Durl
http://45.32.150.251/g/CuSix1P76JsOJIk7kBp9Sg%3D%3Durl
http://217.69.3.51/get_arhive_npm/7j0r9Ddsx6iIfveCYMyduQ%3D%3Durl
http://45.32.150.251/get_arhive_npm/1hSS+kiByorP8+9JrXLvgg==url
http://217.69.3.51/get_arhive_npm/B6krsSuUkEYBUqrxN3%2BasQ%3D%3Durl
http://217.69.3.51/iX%2B3AQBUlXMclYYlBqLD7Q%3D%3Durl
https://go.getblock.us/86aac42ad4484f3c813079afc201451curl
http://45.32.150.251/get_arhive_npm/TF3wpi1E5Y1y%2B6LY7%2FZj5g%3D%3Durl
4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bdhash
24269ae7a306178f21a7e0b4502358d1d0931eded86c3a9caa5ea8471ba34ce3hash
50a891fe72f61b91bca13326f7b334437054fe8e6d6620665c3d47b0118c7792hash
69017b82c6d80c3e0dd87898cdd533f104dc2b06c9fcaadfe2943b9c82228924hash
9a3eeeeac57f58a79659ebf0782fe2abd6b646e8960fcb5e99fb905db5728559hash
1f51780838c5ca56336645bfc6e2812f4a68b8abd6d02bf62bc308b62a583bb8hash
a9c9af685d1144dbc81bebf40dbb0e5bf66688bf034ac8b0f9d2094b9afee41ahash
22636bbb9e1f26a4ce31fa185d4a4add37580888b6376922aa364a8032490dcbhash
2ba01d4141fce7342a7f0cc330e6c08da83cfe5d4bfd1a79b69f20d2b1f4f7e5hash
4430b9f555dfca96555698de32fecd0fd1e099c3f4690c13fb169f4c8972ce9dhash
c97a93c76f55bbb71fa255ed988a9671731dc28ec00103dd2d7b0d02a4dfa8f0hash
c9444fffb98de28ee1582aac098c2677ecd2b4bb1c6578fbb782c1c338889007hash
6ccbe0765ecb9f4cfffc6cd7176ecb989cd7b4b371e4924563f708d44d935869hash
3a79036ce04c504a193d85ddcc34a4ca5df583a64bfff81fc0b53b03d16de6e9hash
4e339dcdc3e3a8bf5271f7f76a9c4f064d3e34cbb51f8770ff4cce910fbcbce5hash
41caca39e0605527f6124e18902b8719131b1e13531fa5b71da4020ea6b9e1a7hash
fe06f0d6324dca4359f87e4fea76c4068e6bf7265962407f2c67828e128097f6hash
c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ecehash
45552a3670e52f13df24b403a8d450b592b556bea9e3343e7d38cd3e0921743dhash
baa6d18542a5bbcfa6beec942660cf8e7988e14a727d775a5c90313ec7392a96hash

Another file to check? Run a file hash reputation check.