2026-08-03_2a4cbeb9d48459bfe5ca9af5e57f2708_glassworm_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2a4cbeb9d48459bfe5ca9af5e57f2708_glassworm_hijackloader_icedid_njrat_vidar
Size 1.6MB
Sample260803-ddgejsbk8x
SHA256 e65f81078a0155154ca4d4da0f899592a8242780a888469fc3a1e781a1d4506b
MD5 2a4cbeb9d48459bfe5ca9af5e57f2708
SHA1 b8c8720c705340d9ea43ff3740425c3fda34c2ba
SHA512 44876f57d0ec60c668b5b327bde2dc9752b9a50bd04759154ec7d2f7270e350dabd9c01ba6d46a4a576a57ac24e931a71f8ef5d1f2a75c421eb62f2a21be6683
SSDEEP 49152:Jv8odu6DUdkjuYl95VUjBvLSsmTy3oCCy:Jv8oidkjuYl95VUjpICCy
TLSH
T129757C6AA7F810E4D1BFC178C5574617F6B2B429132097CB16A087BA5F23BD06B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-03_2a4cbeb9d48459bfe5ca9af5e57f2708_glassworm_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-03_2a4cbeb9d48459bfe5ca9af5e57f2708_glassworm_hijackloader_icedid_njrat_vidar

.exe 1.6MB

2026-08-03_2a4cbeb9d48459bfe5ca9af5e57f2708_glassworm_hijackloader_icedid_njrat_vidar

IMPHASH 352ba68fec50f57be7f4f5f52e819254
SHA256 e65f81078a0155154ca4d4da0f899592a8242780a888469fc3a1e781a1d4506b
MD5 2a4cbeb9d48459bfe5ca9af5e57f2708
SHA1 b8c8720c705340d9ea43ff3740425c3fda34c2ba
SHA512 44876f57d0ec60c668b5b327bde2dc9752b9a50bd04759154ec7d2f7270e350dabd9c01ba6d46a4a576a57ac24e931a71f8ef5d1f2a75c421eb62f2a21be6683
SSDEEP 49152:Jv8odu6DUdkjuYl95VUjBvLSsmTy3oCCy:Jv8oidkjuYl95VUjpICCy
TLSH
T129757C6AA7F810E4D1BFC178C5574617F6B2B429132097CB16A087BA5F23BD06B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0f:44:ba:03:e2:19:1d:6c:96:8f:fe:b8:c3:2e:70:fd:f2:a5:5c:72:c6:15:de:5f:89:ce:ec:5d:c0:09:21:e9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Dec 12, 2024

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2022 - Oct 17, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

469204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACloseEvent send ioctlsocket WSACreateEvent WSAEnumNetworkEvents gethostname getsockopt WSAIoctl getpeername sendto recvfrom freeaddrinfo getaddrinfo setsockopt recv listen htonl getsockname connect bind accept select __WSAFDIsSet socket htons WSASetLastError ntohs WSAGetLastError closesocket WSAEventSelect

wldap32

ord46 ord217 ord30 ord211 ord60 ord301 ord200 ord143 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45

advapi32

OpenProcessToken LookupPrivilegeValueW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt AdjustTokenPrivileges

crypt32

CertFreeCertificateContext CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertCloseStore CertFreeCertificateChain

normaliz

IdnToUnicode IdnToAscii

kernel32

CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode WriteFile SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread LCMapStringW ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW DeleteFileW GetTimeZoneInformation HeapSize WriteConsoleW lstrcmpiW RtlUnwindEx IsDebuggerPresent RaiseException Sleep GetCurrentProcess ExitProcess GetTickCount64 VirtualProtect GetModuleHandleA GetProcAddress CreateFileW CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcessId CreateThread OpenProcess GetSystemDirectoryW VirtualAllocEx WriteProcessMemory CreateFileMappingW MapViewOfFile FreeLibrary GetModuleFileNameW GetModuleHandleW LoadLibraryA RtlUnwind lstrcatW K32EnumProcessModulesEx K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation CreateToolhelp32Snapshot Process32FirstW Process32NextW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryA QueryPerformanceCounter GetTickCount GetFullPathNameW MultiByteToWideChar WideCharToMultiByte SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx RtlPcToFileHeader GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ntdll

RtlDecompressBuffer

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2a4cbeb9d48459bfe5ca9af5e57f2708_glassworm_hijackloader_icedid_njrat_vidar

PE Signature issue

ws2_32

wldap32

advapi32

crypt32

normaliz

kernel32

version

ntdll

bcrypt

generic