2026-08-04_48b5e236cabfc60426d619390c495061_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_48b5e236cabfc60426d619390c495061_cobalt-strike_glassworm_icedid_njrat_vidar
Size 5.3MB
Sample260804-213hasfn4t
SHA256 ee36e14922d780057e67bed0790eb3b32e538db6d6c17796f529813ae0ed33ff
MD5 48b5e236cabfc60426d619390c495061
SHA1 a5e31c29f53cd23aa5438726460ee7684c27b926
SHA512 db369026a3b0e9b24e3df2a5a3a386449bf2c0346b2ab379e76121d479d46a2cd1bf0276cdfdfbbf01f75ae77cf43560dc85d0d44523e1cb6bb832c9c611f4c4
SSDEEP 49152:RvSEmqtc6xZ+1t3bImYqYa6nJ/uETWu97RLGYjS6ZexnJq112lCbGPHx22dxhX/r:oNlPvRC2lVJeAPvXvYCp3nyG
TLSH
T19446281673F81388E1F7967C96B75616CA72BC198B21C7CF0160915E1E33AE48D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_48b5e236cabfc60426d619390c495061_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-08-04_48b5e236cabfc60426d619390c495061_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 5.3MB

2026-08-04_48b5e236cabfc60426d619390c495061_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 20136688e62a447a707b9be19cc4f6bf
SHA256 ee36e14922d780057e67bed0790eb3b32e538db6d6c17796f529813ae0ed33ff
MD5 48b5e236cabfc60426d619390c495061
SHA1 a5e31c29f53cd23aa5438726460ee7684c27b926
SHA512 db369026a3b0e9b24e3df2a5a3a386449bf2c0346b2ab379e76121d479d46a2cd1bf0276cdfdfbbf01f75ae77cf43560dc85d0d44523e1cb6bb832c9c611f4c4
SSDEEP 49152:RvSEmqtc6xZ+1t3bImYqYa6nJ/uETWu97RLGYjS6ZexnJq112lCbGPHx22dxhX/r:oNlPvRC2lVJeAPvXvYCp3nyG
TLSH
T19446281673F81388E1F7967C96B75616CA72BC198B21C7CF0160915E1E33AE48D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26561

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\76724\LVInstaller\VideofusionInstaller\src\FeedbackTool\x64\CC_RELEASE\FeedbackTool.pdb

dbghelp

SymCleanup SymFunctionTableAccess64 SymGetModuleBase64 SymGetLineFromAddr64 SymSetOptions SymGetSearchPathW SymSetSearchPathW SymFromAddr StackWalk64 SymInitialize

propsys

InitPropVariantFromCLSID

ws2_32

ioctlsocket

powrprof

PowerDeterminePlatformRoleEx

setupapi

SetupDiEnumDeviceInfo CM_Get_Device_IDW SetupDiGetClassDevsW

winmm

timeEndPeriod timeGetTime timeBeginPeriod

kernel32

OpenProcess GetWindowsDirectoryW FreeLibrary LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetCurrentThread GetCurrentDirectoryW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime DecodePointer InitializeCriticalSectionEx DeleteCriticalSection GetFileInformationByHandle GetLocalTime GetTickCount CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime ProcessIdToSessionId GetCommandLineW GetEnvironmentVariableW CreateFileA GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetTempPathW GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetVersion GetSystemDirectoryW LocalAlloc lstrcmpW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW CopyFileW MoveFileExW WTSGetActiveConsoleSessionId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent CreateEventW CreateThread MoveFileW InitializeCriticalSectionAndSpinCount GetCurrentThreadId LoadLibraryExW lstrcmpiW K32EnumProcessModules SetCurrentDirectoryW GetFileAttributesExW GetFinalPathNameByHandleW GetLogicalDriveStringsW GetVolumePathNameW DuplicateHandle GetModuleHandleA ReplaceFileW CreateHardLinkW FindFirstFileExW GetProcessId OutputDebugStringA FormatMessageA GetModuleHandleExW GetNativeSystemInfo GetProductInfo IsWow64Process ReleaseSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency Sleep SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime WaitForSingleObject SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FlushFileBuffers GetProcAddress LockFileEx SetEndOfFile SetFileInformationByHandle SetFilePointerEx UnlockFileEx UnregisterWaitEx RegisterWaitForSingleObject IsDebuggerPresent GetThreadId GetUserDefaultLangID AcquireSRWLockExclusive lstrcmpiA GlobalMemoryStatusEx WaitForMultipleObjects TlsGetValue VirtualAlloc VirtualFree FlushViewOfFile VirtualQuery GetProcessTimes SetPriorityClass GetPriorityClass HeapSetInformation GetSystemInfo GetProcessIoCounters K32GetPerformanceInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsSetValue TlsAlloc TlsFree RtlCaptureStackBackTrace SetUnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetInformationJobObject GetModuleHandleExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce RtlVirtualUnwind CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableCS FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer TryEnterCriticalSection InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx OutputDebugStringW LoadLibraryExA VirtualProtect QueryThreadCycleTime LocalFree GetStringTypeW CompareStringEx GetCPInfo RtlPcToFileHeader RtlUnwindEx GetModuleHandleW GetVersionExW RtlUnwind GetTimeFormatW DeviceIoControl SetFileAttributesW SetLastError GetLongPathNameW GetFullPathNameW ExpandEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar CloseHandle WriteFile ReadFile GetFileSize CreateFileW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetUserDefaultLCID EnumSystemLocalesW GetFileInformationByHandleEx CreateSymbolicLinkW ReadConsoleW GetDriveTypeW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx WriteConsoleW InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode ExitProcess GetDateFormatW GetStdHandle GetLocaleInfoEx

user32

PeekMessageW DispatchMessageW TranslateMessage CharUpperW SetProcessDPIAware RemovePropW PostQuitMessage GetSystemMetrics GetUserObjectInformationW GetThreadDesktop CharNextW DestroyWindow DefWindowProcW GetWindowThreadProcessId GetClassNameW EnumWindows GetWindowLongW GetWindowTextLengthW GetWindowTextW PostMessageW ExitWindowsEx UnregisterClassW GetDesktopWindow GetDC GetQueueStatus SetTimer KillTimer RegisterClassExW CreateWindowExW GetWindowLongPtrW SetWindowLongPtrW MsgWaitForMultipleObjectsEx FindWindowExW SetPropW

gdi32

DeleteObject GetDeviceCaps

advapi32

GetSidSubAuthorityCount SystemFunction036 RegNotifyChangeKeyValue RegEnumValueW ConvertSidToStringSidW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteKeyExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl MapGenericMask IsValidSecurityDescriptor InitializeSecurityDescriptor ImpersonateLoggedOnUser GetFileSecurityW FreeSid EqualSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck LookupPrivilegeValueW RevertToSelf ImpersonateSelf AdjustTokenPrivileges OpenThreadToken SetThreadToken ConvertStringSidToSidW LookupAccountSidW SetTokenInformation GetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW SetNamedSecurityInfoW GetNamedSecurityInfoW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce

shell32

SHGetFolderPathA ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW

ole32

CoCreateInstance CoRevokeInitializeSpy CoRegisterInitializeSpy PropVariantClear CoTaskMemFree CoTaskMemRealloc CoUninitialize CoInitializeEx CoInitialize CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString

shlwapi

StrToIntW ord437 PathMatchSpecW StrChrW StrCmpNW StrCmpNIW StrRChrW StrCmpIW StrCpyNW PathAppendW PathFileExistsW SHSetValueW SHGetValueW PathRemoveFileSpecW PathIsDirectoryW PathGetDriveNumberW PathFindExtensionW PathAddBackslashW ord176

comctl32

InitCommonControlsEx

userenv

CreateEnvironmentBlock UnloadUserProfile LoadUserProfileW DestroyEnvironmentBlock

mpr

WNetGetResourceInformationW

psapi

GetProcessImageFileNameW EnumProcesses GetModuleFileNameExW EnumProcessModules

iphlpapi

GetAdaptersAddresses

??0MemoryAllocatorDumpGuid@trace_event@base@@QEAA@_K@Z ??0ReadOnlySharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??0UnsafeSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@XZ ??0WritableSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0WritableSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0WritableSharedMemoryRegion@base@@QEAA@XZ ??1ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??1UnsafeSharedMemoryRegion@base@@QEAA@XZ ??1WritableSharedMemoryRegion@base@@QEAA@XZ ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@$$QEAV012@@Z ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@AEBV012@@Z ??4ReadOnlySharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4UnsafeSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4WritableSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??8MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??9MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??MMemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ?ConvertToReadOnly@WritableSharedMemoryRegion@base@@SA?AVReadOnlySharedMemoryRegion@2@V12@@Z ?ConvertToUnsafe@WritableSharedMemoryRegion@base@@SA?AVUnsafeSharedMemoryRegion@2@V12@@Z ?Create@ReadOnlySharedMemoryRegion@base@@SA?AUMappedReadOnlyRegion@2@_K@Z ?Create@UnsafeSharedMemoryRegion@base@@SA?AV12@_K@Z ?Create@WritableSharedMemoryRegion@base@@SA?AV12@_K@Z ?Deserialize@ReadOnlySharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@UnsafeSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@WritableSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Duplicate@ReadOnlySharedMemoryRegion@base@@QEBA?AV12@XZ ?Duplicate@UnsafeSharedMemoryRegion@base@@QEBA?AV12@XZ ?GetGUID@ReadOnlySharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@UnsafeSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@WritableSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetPlatformHandle@ReadOnlySharedMemoryRegion@base@@QEBAPEAXXZ ?GetPlatformHandle@UnsafeSharedMemoryRegion@base@@QEBAPEAXXZ ?GetSize@ReadOnlySharedMemoryRegion@base@@QEBA_KXZ ?GetSize@UnsafeSharedMemoryRegion@base@@QEBA_KXZ ?GetSize@WritableSharedMemoryRegion@base@@QEBA_KXZ ?IsValid@ReadOnlySharedMemoryRegion@base@@QEBA_NXZ ?IsValid@UnsafeSharedMemoryRegion@base@@QEBA_NXZ ?IsValid@WritableSharedMemoryRegion@base@@QEBA_NXZ ?Map@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@XZ ?Map@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?Map@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?MapAt@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@J_K@Z ?MapAt@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?MapAt@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?TakeHandleForSerialization@ReadOnlySharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@UnsafeSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@WritableSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?ThrowBadVariantAccess@variant_internal@absl@@YAXXZ ?ToUint64@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_KXZ ?UnsafeGetPlatformHandle@WritableSharedMemoryRegion@base@@QEBAPEAXXZ ?create_hook_@ReadOnlySharedMemoryRegion@base@@0P6A?AUMappedReadOnlyRegion@2@_K@ZEA ?create_hook_@UnsafeSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?create_hook_@WritableSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?empty@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NXZ ?g_swallow_stream@logging@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@EA ?kDisableBestEffortTasks@switches@@3QBDB ?kDisableBreakpad@switches@@3QBDB ?kDisableFeatures@switches@@3QBDB ?kDisableHighResTimer@switches@@3QBDB ?kDisableLowEndDeviceMode@switches@@3QBDB ?kDisableUsbKeyboardDetect@switches@@3QBDB ?kEnableBackgroundThreadPool@switches@@3QBDB ?kEnableCrashReporter@switches@@3QBDB ?kEnableFeatures@switches@@3QBDB ?kEnableLowEndDeviceMode@switches@@3QBDB ?kForceFieldTrials@switches@@3QBDB ?kFullMemoryCrashReport@switches@@3QBDB ?kLogBestEffortTasks@switches@@3QBDB ?kNoErrorDialogs@switches@@3QBDB ?kProfilingAtStart@switches@@3QBDB ?kProfilingFile@switches@@3QBDB ?kProfilingFlush@switches@@3QBDB ?kTestChildProcess@switches@@3QBDB ?kTestDoNotInitializeIcu@switches@@3QBDB ?kTraceToFile@switches@@3QBDB ?kTraceToFileName@switches@@3QBDB ?kV@switches@@3QBDB ?kVModule@switches@@3QBDB ?kWaitForDebugger@switches@@3QBDB ?set_create_hook@ReadOnlySharedMemoryRegion@base@@CAXP6A?AUMappedReadOnlyRegion@2@_K@Z@Z ?set_create_hook@UnsafeSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?set_create_hook@WritableSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?throw_bad_optional_access@optional_internal@absl@@YAXXZ GetHandleVerifier

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

minATL

Size

1024B

Virtual Size

809B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_48b5e236cabfc60426d619390c495061_cobalt-strike_glassworm_icedid_njrat_vidar

dbghelp

propsys

ws2_32

powrprof

setupapi

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

userenv

mpr

psapi

iphlpapi

generic