2026-07-12_be52e88a032f4a2fed833748b9310194_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_be52e88a032f4a2fed833748b9310194_glassworm_icedid_njrat_vidar
Size 1.2MB
Sample260712-tnc3wacz2n
SHA256 68ec908fad08a35564afc649d65243c6966c87a1a67e8b2a749f0b3c122d9e88
MD5 be52e88a032f4a2fed833748b9310194
SHA1 eb0b677a36c9380cdddaf164a5aaa444393aa1e2
SHA512 159c225f9b6ef442b498d080cd37c301e02c5ea89dc21ce4a63bf975a146c028ac1828cec808189d91d0502eb66a8fcc6fbfa29b17a27426abd3fd65c458b57e
SSDEEP 24576:lREoRgd3RXFjklChgSKlAOFsoPlfMZRgnQ/tbw/2Mkjy6Fr7g0om:QoRgdhJECOSKiOFsoPlfMZRgQ/lFTjN4
TLSH
T1D545DF6AA3E840FED167C13CC9568612F77274460B609BDF13A0927A1F3B6E65F39321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_be52e88a032f4a2fed833748b9310194_glassworm_icedid_njrat_vidar

File Explorer

2026-07-12_be52e88a032f4a2fed833748b9310194_glassworm_icedid_njrat_vidar

.exe 1.2MB

2026-07-12_be52e88a032f4a2fed833748b9310194_glassworm_icedid_njrat_vidar

IMPHASH 668f91ad79b3ef0d76777aaa1dd4f02e
SHA256 68ec908fad08a35564afc649d65243c6966c87a1a67e8b2a749f0b3c122d9e88
MD5 be52e88a032f4a2fed833748b9310194
SHA1 eb0b677a36c9380cdddaf164a5aaa444393aa1e2
SHA512 159c225f9b6ef442b498d080cd37c301e02c5ea89dc21ce4a63bf975a146c028ac1828cec808189d91d0502eb66a8fcc6fbfa29b17a27426abd3fd65c458b57e
SSDEEP 24576:lREoRgd3RXFjklChgSKlAOFsoPlfMZRgnQ/tbw/2Mkjy6Fr7g0om:QoRgdhJECOSKiOFsoPlfMZRgQ/lFTjN4
TLSH
T1D545DF6AA3E840FED167C13CC9568612F77274460B609BDF13A0927A1F3B6E65F39321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

254784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\buildagent-cd_8811\workspace\11934\VisualStudio\bin\x64\Universal_Release\jhi_service.pdb

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx CreateMutexA LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateMutexW InitializeCriticalSectionAndSpinCount CreateEventW ResetEvent EnterCriticalSection ReleaseMutex SetEvent ReleaseSemaphore CreateEventA DeleteCriticalSection OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindClose FindFirstFileExW SetFileAttributesW FindNextFileW CreateDirectoryW GetFileType FlushFileBuffers SetEndOfFile SetFilePointerEx CreateFileA CreateFileW GetFileAttributesExW FindFirstFileW DeleteFileW ReadFile WriteFile

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter GetLastError RaiseException SetUnhandledExceptionFilter SetLastError

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetCommandLineW GetStdHandle GetCommandLineA SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetEnvironmentVariableW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW FreeLibrary GetModuleHandleW GetProcAddress GetModuleFileNameW LoadLibraryExW

api-ms-win-core-file-l2-1-0

CopyFileExW MoveFileExW

ws2_32

WSACleanup accept bind closesocket listen getaddrinfo connect WSAGetLastError freeaddrinfo WSAStartup recv ntohs socket send getsockname shutdown

api-ms-win-core-com-l1-1-0

CoCreateInstance CoInitializeEx CoUninitialize

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes GetExitCodeProcess ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThreadId CreateThread GetCurrentProcessId GetCurrentProcess TerminateProcess GetStartupInfoW

api-ms-win-core-io-l1-1-0

GetOverlappedResult DeviceIoControl

api-ms-win-core-synch-l1-2-0

Sleep SignalObjectAndWait

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW CM_Register_Notification CM_Unregister_Notification

api-ms-win-security-provider-l1-1-0

SetSecurityInfo SetEntriesInAclW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrlenA

api-ms-win-core-kernel32-legacy-l1-1-4

GetMailslotInfo

api-ms-win-core-kernel32-legacy-l1-1-0

CreateMailslotA

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-service-management-l2-1-0

SetServiceObjectSecurity QueryServiceObjectSecurity ChangeServiceConfig2W

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-service-management-l1-1-0

DeleteService OpenSCManagerW OpenServiceW CreateServiceW StartServiceW CloseServiceHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor GetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-heap-l2-1-0

LocalFree

oleaut32

SysAllocString VariantClear SysFreeString SafeArrayGetUBound VariantInit GetErrorInfo

advapi32

RegisterEventSourceW BuildExplicitAccessWithNameW DeregisterEventSource ReportEventW

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-heap-l1-1-0

HeapSize HeapAlloc HeapReAlloc HeapFree GetProcessHeap

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlUnwindEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

IsValidCodePage LCMapStringW IsValidLocale GetUserDefaultLCID GetCPInfo FormatMessageW EnumSystemLocalesW GetACP GetLocaleInfoW GetOEMCP

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte CompareStringW GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-console-l1-1-0

ReadConsoleW GetConsoleCP GetConsoleMode WriteConsoleW

Name

.text

Size

421KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_be52e88a032f4a2fed833748b9310194_glassworm_icedid_njrat_vidar

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

ws2_32

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-security-provider-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-4

api-ms-win-core-kernel32-legacy-l1-1-0

rpcrt4

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-heap-l2-1-0

oleaut32

advapi32

api-ms-win-core-io-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-console-l1-1-0

generic