2026-07-23_e9de966ff3053b01f7952f5a0b2d6ff5_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_e9de966ff3053b01f7952f5a0b2d6ff5_glassworm_icedid_njrat_vidar
Size 1.2MB
Sample260723-wlmkmscc68
SHA256 ef28dff62f169944415b94d77b808f5cbf0a523fdb4593299bc5f8182335b8db
MD5 e9de966ff3053b01f7952f5a0b2d6ff5
SHA1 86d74099b029475b40ca26859dab5c3880027c3c
SHA512 06062af95630efd1ea6d0200f25921b2d935bfbd99bf1717ee5fec8abba70dffeb0ebcbd3025b625b63327010ac38eeee15a24d3d914b3972a503088c45b64b4
SSDEEP 24576:NIhnI1Fu0HTZNwJZ+jCv8ToJlpkMZqasqjnhMgeiCl7G0nehbGZpbD:mnI1Fr0r+Ov8ToJluMZquDmg27RnWGj
TLSH
T16945DF9AA7A840FDD177C13CC9938612F672B84607708ADF13A0567A2F376E65F39321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_e9de966ff3053b01f7952f5a0b2d6ff5_glassworm_icedid_njrat_vidar

File Explorer

2026-07-23_e9de966ff3053b01f7952f5a0b2d6ff5_glassworm_icedid_njrat_vidar

.exe 1.2MB

2026-07-23_e9de966ff3053b01f7952f5a0b2d6ff5_glassworm_icedid_njrat_vidar

IMPHASH a8b6109ee657b45fbdca02e4e58004ba
SHA256 ef28dff62f169944415b94d77b808f5cbf0a523fdb4593299bc5f8182335b8db
MD5 e9de966ff3053b01f7952f5a0b2d6ff5
SHA1 86d74099b029475b40ca26859dab5c3880027c3c
SHA512 06062af95630efd1ea6d0200f25921b2d935bfbd99bf1717ee5fec8abba70dffeb0ebcbd3025b625b63327010ac38eeee15a24d3d914b3972a503088c45b64b4
SSDEEP 24576:NIhnI1Fu0HTZNwJZ+jCv8ToJlpkMZqasqjnhMgeiCl7G0nehbGZpbD:mnI1Fr0r+Ov8ToJluMZquDmg27RnWGj
TLSH
T16945DF9AA7A840FDD177C13CC9938612F672B84607708ADF13A0567A2F376E65F39321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

251952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\buildagent_prod_8811\p4\1598850468\services\DAL\Src\VisualStudio\bin\x64\Universal_Release\jhi_service.pdb

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore CreateEventW EnterCriticalSection LeaveCriticalSection ReleaseMutex CreateEventA InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent CreateMutexA WaitForSingleObjectEx InitializeCriticalSection WaitForSingleObject ResetEvent OpenEventA CreateMutexW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

CreateFileW FlushFileBuffers SetFileAttributesW ReadFile CreateDirectoryW GetFileType DeleteFileW GetFileAttributesExW FindNextFileW FindFirstFileW SetEndOfFile SetFilePointerEx FindClose WriteFile FindFirstFileExW CreateFileA

api-ms-win-core-errorhandling-l1-1-0

SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError RaiseException

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA GetEnvironmentStringsW ExpandEnvironmentStringsW SetStdHandle GetStdHandle SetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW

api-ms-win-service-core-l1-1-3

GetServiceRegistryStateKey

api-ms-win-core-file-l2-1-2

CopyFileW

ws2_32

closesocket connect WSAGetLastError freeaddrinfo accept recv ntohs socket send getsockname WSAStartup getaddrinfo bind shutdown listen WSACleanup

api-ms-win-core-com-l1-1-0

CoCreateInstance CoUninitialize CoInitializeEx

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes ExitProcess TlsSetValue TlsFree GetExitCodeProcess TlsGetValue TlsAlloc GetCurrentThreadId GetCurrentProcessId GetCurrentProcess TerminateProcess CreateThread GetStartupInfoW

api-ms-win-core-io-l1-1-0

GetOverlappedResult DeviceIoControl

api-ms-win-core-synch-l1-2-0

Sleep SignalObjectAndWait

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW

api-ms-win-security-provider-l1-1-0

SetSecurityInfo SetEntriesInAclW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrlenA

api-ms-win-core-kernel32-legacy-l1-1-4

GetMailslotInfo

api-ms-win-core-kernel32-legacy-l1-1-0

CreateMailslotA

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W QueryServiceObjectSecurity SetServiceObjectSecurity

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-service-management-l1-1-0

CloseServiceHandle DeleteService OpenSCManagerW OpenServiceW CreateServiceW StartServiceW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW LoadLibraryExW GetModuleFileNameW FreeLibrary GetModuleHandleExW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl GetSecurityDescriptorDacl AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-heap-l2-1-0

LocalFree

oleaut32

SysAllocString SafeArrayGetUBound VariantInit VariantClear GetErrorInfo SysFreeString

user32

UnregisterDeviceNotification RegisterDeviceNotificationW

advapi32

ReportEventW RegisterEventSourceW BuildExplicitAccessWithNameW DeregisterEventSource

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapFree HeapAlloc HeapReAlloc

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

FormatMessageW IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCPInfo GetACP GetOEMCP LCMapStringW GetLocaleInfoW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar CompareStringW GetStringTypeW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-console-l1-1-0

GetConsoleCP GetConsoleMode WriteConsoleW ReadConsoleW

Name

.text

Size

419KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_e9de966ff3053b01f7952f5a0b2d6ff5_glassworm_icedid_njrat_vidar

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-service-core-l1-1-3

api-ms-win-core-file-l2-1-2

ws2_32

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-security-provider-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-4

api-ms-win-core-kernel32-legacy-l1-1-0

rpcrt4

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-heap-l2-1-0

oleaut32

user32

advapi32

api-ms-win-core-io-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-console-l1-1-0

generic