2026-07-30_234e850b799c348e20da7d9390132d4e_glassworm_icedid_njrat_remcos_vidar

General

Target
2026-07-30_234e850b799c348e20da7d9390132d4e_glassworm_icedid_njrat_remcos_vidar
Size 22.3MB
Sample260730-edkyeayfra
SHA256 3257bb90ec45782521bda0f6061ada4b2d5af75a872893540a846ad705b2b0df
MD5 234e850b799c348e20da7d9390132d4e
SHA1 4463a07b0afcd6790ab7096648439c437415cf11
SHA512 7f500a4e20f86d225186423dbd2a28df1255a0bc948a04e211b3d13b72a90afa399e9c91ff64bbbf5f79c92cf6779673720c73232686d0ca66526a97469a339a
SSDEEP 196608:YYJxpSkmB/OVFYLgyh7xnXUyvrqNKqzm0FSVmyu4IojnC:LpG/SFYHh7NkyvrqNvzm0JBsnC
TLSH
T1C9377C29A6A840E4D177C17DCAA2C543EBB338211F3597DB716D572E1F37AE08D39222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_234e850b799c348e20da7d9390132d4e_glassworm_icedid_njrat_remcos_vidar

File Explorer

2026-07-30_234e850b799c348e20da7d9390132d4e_glassworm_icedid_njrat_remcos_vidar

.exe 22.3MB

2026-07-30_234e850b799c348e20da7d9390132d4e_glassworm_icedid_njrat_remcos_vidar

IMPHASH 1bca8e9219039738c93ab4dc2c3ab216
SHA256 3257bb90ec45782521bda0f6061ada4b2d5af75a872893540a846ad705b2b0df
MD5 234e850b799c348e20da7d9390132d4e
SHA1 4463a07b0afcd6790ab7096648439c437415cf11
SHA512 7f500a4e20f86d225186423dbd2a28df1255a0bc948a04e211b3d13b72a90afa399e9c91ff64bbbf5f79c92cf6779673720c73232686d0ca66526a97469a339a
SSDEEP 196608:YYJxpSkmB/OVFYLgyh7xnXUyvrqNKqzm0FSVmyu4IojnC:LpG/SFYHh7NkyvrqNvzm0JBsnC
TLSH
T1C9377C29A6A840E4D177C17DCAA2C543EBB338211F3597DB716D572E1F37AE08D39222
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

998144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\projects\drweb-agent\testing\drweb-agent\x64\Release\SpIDerAgent.pdb

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlUnwind RtlUnwindEx VerSetConditionMask

kernel32

TlsSetValue QueueUserWorkItem GetProcAddress GetModuleHandleW VerifyVersionInfoW SetEvent CreateEventW CloseHandle WaitForSingleObject WaitForMultipleObjects GetLastError GetCurrentProcessId GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindResourceW LoadResource LockResource SizeofResource GetCurrentThreadId InitializeCriticalSectionEx RaiseException GetFileAttributesW FreeLibrary LoadLibraryW SetLastError LoadLibraryExW GetSystemDirectoryW DecodePointer EncodePointer GetTickCount FileTimeToSystemTime LocalFree GetCurrentProcess ReleaseSemaphore WideCharToMultiByte FormatMessageW FormatMessageA CreateEventA TlsFree TlsAlloc OpenProcess Sleep GetLocalTime CreateFileW DeviceIoControl WriteProcessMemory SetUnhandledExceptionFilter CreateSemaphoreA WaitForSingleObjectEx WaitForMultipleObjectsEx HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap lstrcmpiW MultiByteToWideChar GetModuleFileNameW CreateProcessW GetEnvironmentStringsW SetErrorMode GlobalAlloc GlobalLock GlobalFree GlobalUnlock lstrlenW DebugBreak OutputDebugStringW lstrlenA PostQueuedCompletionStatus TerminateThread QueueUserAPC GetVersionExW GetVersion GetVersionExA ProcessIdToSessionId CreateMutexW OpenMutexW DuplicateHandle CreateFileA GetFileType SetFilePointer ReadFile SystemTimeToFileTime GetCurrentDirectoryA DosDateTimeToFileTime WriteFile LoadLibraryExA ExpandEnvironmentStringsA FindClose FindFirstFileW FindNextFileW GetComputerNameExW CreateFileMappingW GetComputerNameW ReleaseMutex FreeEnvironmentStringsW GetCommandLineW GetCommandLineA WriteConsoleW GetOEMCP IsValidCodePage FlushFileBuffers EnumSystemLocalesW GetStdHandle ExitProcess SetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode SetEnvironmentVariableA GetACP VirtualQuery GetModuleHandleExW ExitThread UnregisterWaitEx QueryDepthSList InterlockedFlushSList VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber SetWaitableTimer CreateWaitableTimerW InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus SleepEx TlsGetValue GetSystemTimeAsFileTime CreateIoCompletionPort GetTimeZoneInformation GetSystemDirectoryA LoadLibraryA GetOverlappedResult CreateDirectoryW RemoveDirectoryW GetFileAttributesExW DeleteFileW SetFilePointerEx MoveFileW RestoreLastError GetFileSize ExpandEnvironmentStringsW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetThreadLocale GetDriveTypeW SetEndOfFile GetUserDefaultLangID IsValidLocale UnmapViewOfFile CreateFileMappingA MapViewOfFile GetStringTypeW TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread GetCurrentThread GetExitCodeThread FindFirstFileExW GetFileInformationByHandle AreFileApisANSI GetCPInfo CompareStringW LCMapStringW ResetEvent UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree OpenEventA ResumeThread GetSystemInfo GetLogicalProcessorInformation GetModuleHandleA CreateWaitableTimerA GetStringTypeExW LCMapStringA GetUserDefaultLCID GetStringTypeExA GlobalSize GetLocaleInfoA FindResourceA MulDiv SetThreadLocale VerifyVersionInfoA GetNumberFormatW GetCurrencyFormatW GetStringTypeA GetSystemTime FlushViewOfFile GetFileTime GetFullPathNameW MapViewOfFileEx CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer

Name

.text

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

714KB

Virtual Size

805KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=198, id=243, version=40116,

count=35, id=242, version=40116,

count=14, id=260, version=27051,

count=19, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,

count=8, id=199, version=41118,

count=11, id=259, version=26706,

count=39, id=260, version=26706,

count=4, id=259, version=27054,

count=7, id=261, version=27054,

count=129, id=261, version=27051,

count=12, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=5, id=203, version=65501,

count=3, id=208, version=65501,

count=1, id=209, version=65501,

count=8, id=206, version=65501,

count=740, id=1, productName=Unmarked objects,

count=151, id=261, version=26706,

count=838, id=265, version=27054,

count=1, id=255, version=27054,

count=2, id=151,

count=1, id=258, version=27054,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_234e850b799c348e20da7d9390132d4e_glassworm_icedid_njrat_remcos_vidar

ntdll

kernel32

generic