2026-08-03_b9168c403e287e1a31acaab9efb0f135_glassworm_hijackloader_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_b9168c403e287e1a31acaab9efb0f135_glassworm_hijackloader_icedid_njrat
Size 6.9MB
Sample260804-l3abjacm8x
SHA256 58648a71e3753b79cea11777f8f9082d0f6efca2e27b5bd1a4778aa8d86a7338
MD5 b9168c403e287e1a31acaab9efb0f135
SHA1 3a45803853d1eb2407c4c1b0ba1ad2146986c757
SHA512 60c555c3f1441e5ac32c1f21549e85bc69a66eed05315ec81c3e2c37f7476d1a72d5232597f4a707cc6180179ebf0833efbd1ec79336b3cde61b38caf89a71a7
SSDEEP 98304:Qd2SlskEZKzpmIqedsvneGpwdpQXHpzuRswc2u8VzrlGJqXzzFulM+4JclWSV7SY:QdYsV3eneXQwcncIJgwMfea+
TLSH
T16676E027F73481F2C1B3C079C4A29B65EA7174858B3197CB5280972D1F676E98EBA331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_b9168c403e287e1a31acaab9efb0f135_glassworm_hijackloader_icedid_njrat

File Explorer

2026-08-03_b9168c403e287e1a31acaab9efb0f135_glassworm_hijackloader_icedid_njrat

.exe 6.9MB

2026-08-03_b9168c403e287e1a31acaab9efb0f135_glassworm_hijackloader_icedid_njrat

IMPHASH 233b4727036a849e444ae38e81648110
SHA256 58648a71e3753b79cea11777f8f9082d0f6efca2e27b5bd1a4778aa8d86a7338
MD5 b9168c403e287e1a31acaab9efb0f135
SHA1 3a45803853d1eb2407c4c1b0ba1ad2146986c757
SHA512 60c555c3f1441e5ac32c1f21549e85bc69a66eed05315ec81c3e2c37f7476d1a72d5232597f4a707cc6180179ebf0833efbd1ec79336b3cde61b38caf89a71a7
SSDEEP 98304:Qd2SlskEZKzpmIqedsvneGpwdpQXHpzuRswc2u8VzrlGJqXzzFulM+4JclWSV7SY:QdYsV3eneXQwcncIJgwMfea+
TLSH
T16676E027F73481F2C1B3C079C4A29B65EA7174858B3197CB5280972D1F676E98EBA331
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3593240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\workplace\Androws\p-7d68863d948e420ab9a4fb3b8ab99713\Build\bin\Release\GameAssistInstaller.pdb

p.i

bTbjWavBqYmszVrqX CCEsv eLjJobLAgTVQUtOyUoSUaDr bKiYwboIyyMZ MwzddJsLPHCO QTSybPcdzyz YcaxohKYGKaKUNnYzoKFNdK JCadYwTjzxyLsuCKKQvKeKu toWDlfbslMipYkmdKQ LLsVpFVloPvaPyI JUxJnyhUbuEaf JxZfyRYvZvMJNl tsHRffTbgrDZGBPvHgn eEITNMnOyZZChbcFhuMVoXICiyx FvzQnj VjrbHfPvYYRjUIcavkFB leCoCUSHPgA xTOpaNEYsBpR zUBUZfEXIYhB JeVUrEoIqt dxzwkXqJ AGhXZuVVLotVjcFBahA tRGNTu rQULavdgqkI hhKnpQOalFJHOOAF lOfGcwdqMhufKKLHXlUkjcg KEFoFuSJknHsTc qvhVJXAcnop bIoSoxlKjbDseYjFgozl zdACCxGSdNwOTE JNDTLJRYjFcaISudnNrwTrWJlJRuPwEcRpXuB GwAaKArAnmYHubhcIOx VdoUmYUJqmpqvDejnX xioAKlTfEDu puERlfkJPdTR PSDOwHCUc wiDxHcWdd xDFMoRwV fMGCjoYZMHLqHHPaRFkg TAKYPNzFflxIzfCWOMnM LxnRKWC EqhKXPpshazsUqMtYghrgYzfq rLTPBRNeRaztcsdsAQj bCLcKGohDpTlbtKKWfTbboB UZYIEByWmcryxHxwNNQAw HPERBuCQgkacDIwBpBPsyuk dIZjNCxOpajC lYjniKoiVpKbTJHW CPOJGytULnXV FctIlMksFNsQ mfpoYHyOjsndUNYGKjHN uDUBLhEWJfRvkJCN ICYAeuRtUQQwbUDhmW UNghdVMlzUPeckAmCoVoEZADK LZFmKAZae MnhgEqfmAfbwti rKYMsAlNTEAhn HZDYeZgzcTdC KzGzfpJJjTuzywLAwitiACJCZv OSGWzuTjQOC lZOwlyGdtwrsTFaulP PwxvRNSvb WbKWIBxrZeiS iHzVzhaIeTW WGwDtCJdWiwZXLGe vuuIlkDFhzQFA OsKobyLemRrINNzEDg bvWxWciHRSIFqG wijjJdxzcSyGm cqVDcPinju wDDgjQjvAi WolrNlnPdBG jcBLzokbxxU pskwqUTKijn jXsmmChGuURWGWc hbkONBRCUoFynUazRJ ItSywqoTZYHKlHjWEb QgRLywZYecWUDSYcT RRwDHXSnFEZw UkOsTJSpDIYj ZBUXLeUeCbyCzRn bGmwOHAwxXXD zdSFOnTpulzB aLMzZWbEpoHqPfBk XFUpLkXM CLxQxlyfYncEbhhVCO ZiVRLuTqKX KzacfBbVamjihGR dSWACOhUWWPawCfQPJaPFel MlOzRfQGwdOLAHD pSxMybOfQWKtUWLZtImUjFLMnR YTzLcIjaRJonqWyxkBldpaWx xXdpgCYnpoRo pqSOLABl iOGqNsvvKRghuegI stfiadqvvjzwIwJpyhNqfbot JtoeMLpfqSbFNroyORWwr sjFobVXYwNPDyZ lbAcEVfDr jydpbQWgALXxM hijOrIJiLKy MldBWgyvkvRSIIYx cdjmeucNMitrzeTxoO JXAmuBgerSmrRyWdBwaOiwY AfqdbqPxqjjrbLCTxJVgG zrrjFhAFhCOPTqHv RkWysDDYcG mAXSCUjmwmTJi zrvepLTooUfqvtUBjAt wqKdemyIFojrkuJDhtHEbAt bWjXMlKLUxzVpMJEFBQKgIItS IVmSTmGidFwtDV hCdsSlhYuPKui VZpmJalmMfwGyBseFoJWkQzCYhyV ONBUoNlyDWpWuiYylxw XteaBUkRMmYAHvmf UrWhPKzuxxVPdYZa pgjqhnRfmtUI hkJxXQHoCkM auxuGWBdHRfYbMgwO iFlBHCxbYTQIYRqTqYuvtfccPzT VgaaQQoErlSaqAXDkelVBYrj aLCfHFPjmardcnpXCIPrJM vTqflcaJARRnxVVkh fRYnrKYGhOhGeJCjcqQ mDSkuImXOo yDQRfxMlr DDiyLhAfkBctxIH WsPjwdUPegThN uBIfjXleBqjHh nrChOWOssyUZZkIDHONM gOSpjTWKknnwbPsSvnaD pqtNtCgBPiFTtKAJAhI aogNHhGpRvsNIKzdPmRe hMSlQuWuLRdXUpsNSbCE KsqyyADtIACTpSKUFgxzYdJBulyvqX equGljUhLYZunJKXP BDbKRtvslqgPgi qjMZZmasYzLPfICoWhcIJhzNYEdo zWtyDWggVPrgfJUCHfbmdtqVDQ zqjxGbWtGPYZjepk fJxOhjemkBdAGiLiIcwmdVk wJGytsKYtuvsMkSe GSuJPmmAqhJq gzaPgKwnXHdDfDZgBEukhHIEE pvKtZInArskKgWTfFRhtwFfR oTIhoLVnEglrsQLovyRrGJly GpBvOoMsMgEgVxRBBCmZY BXglzqpJjgJQITochtpddcQwQPj gjyrGigVEOIUFgZWmLfZndH sJMvpbUbWsOhlQbLPVtjhrX pgFnstdNyZlvWYoVP VxYmVZtDeFLLpRLPOkn WDByuWcWeT HIXQfisyIkMVdx WNyTsGbgclvf rFDCcykXnUUvnvekMLR EPpKqXVqPrSheByQF FuoSHuzYJr XDIHyELxufRgEG RfHYLwZfqhxPJklBRU ewXsqNQNMTOZasyB YbgwqyGclcKmDJ llOrAmLPeeNHjEFANNfrCf VwcCKysxXUGyLfgJWkft LqBZpzsFugEHWj rKknOcOFnHHkItzWIc YaYsbhfpiYOKASNiJgeYpJp cKRZvCNxNmnYcLG kaUdIsMa CEuMQbaspUsaUj GaVaSHMMf JrjLgnqhKnh sIpqktmGIaXDtp YmwFPblHjSgIngf DWheUtwmDmrRHzlsBrbijPyc NZxCDbrnDHZ IXkPnyJtK oXhHTWjMpgzsVkQxr AqSWmvHKxmZllrVy jfMEhxgCURby fPtBIpXtgPTKQHFLIEm ivmYwVxCpQQPh gRYoOTZdqJEOrZwJRJyPM fNmjGwmGsyzeLDecLchcpIqdHbg hrpmJfDsxAIX MUPgQGkgyHYJJE PVftrqqrgxeLPM AJoiimDuiYpB uUNOopcOQtBsIrdHyUyG frmyKtgfbfNeaiQVLNti ORQBDuxWOyuwJjAtIkIWzvKJFaxOXyZOuo mNFTVxDIwPmbmgC gFFFFVEuGdHy HJIZgYaPOzJUqJ yhhKSamIrKxk AQfYxWLeorym GdgFiisdTNBtj DcdWoORPQxINjKqMVs XpbFoHheItdfEDOy AhfBeIeC gACHNKSGtqBVu KNqpBVBMGat wsWqCgHEldp SPNxfCquxdMXQVAPvv tguNoOEeE LUqJqdrVWodazDc hTgpCilSgQLvZAD zGwsBGLyIol dwltyovaxKgGlOgCJLEuMZPba jQyApISW joonKuCYLWC qcYoISQfteT vJxHaQh XHDKSwdNOckned CopLpqqfAVeW YlqSvpPjJk LGQEanYcukzCAMZboYwLIGgh AnxZZLyypfIZvJOOAUznkmFyAiNEJtX EOEyJxsuqsBFV tSCYztBHhpJqFilRcuJWy wzOfPLBkxBaa MXXpXVHOUYpvIuieQuaNhrY obZQAYDiuraCyT ANUttoaEGHcb huBOYilqAqXOFoqtQQ tRzaCBrDyrWLJu IgJDfHnAGykDGD dUeVSndkDhioPp TQOjruexFwYv arGHOUorEZqnG FgmUxuYUInXeFFLgnS BsuUXLMDxCaXhleKCA XHCZppqSvRBD wikiaqmdJfcOMS mdHjnwrgvplYnyoWV FvVZUlLabaFqqys dQmzQCGo qOiLYBfVxDekuuwySSmmIH KUCIXPDHjIfBzrimNRWVxwU GvTcGoBw XvCGWozuMTO uiUTcSvMw

?BeaconDeviceId@BeaconClient@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?InitSDK@BeaconClient@@SAXAEBUBeaconConfig@@@Z ?PrepareParams@BeaconClient@@KA?AV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AEBV23@_J@Z ?Report@BeaconClient@@SAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@@Z ?UninitSDK@BeaconClient@@SAXXZ ?common_param_getters@BeaconClient@@SAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@XZ ?common_params@BeaconClient@@SAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@XZ ?config@BeaconClient@@SAAEBUBeaconConfig@@XZ ?set_common_param_getters@BeaconClient@@SAXAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@@Z ?set_common_params@BeaconClient@@SAXAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@Z

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

275KB

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QMGuid

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SYGuid

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=20, id=259, version=27412,

count=227, id=261, version=27412,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=117, id=261, version=30034,

count=10, id=253, version=28518,

count=3, id=263, version=27412,

count=41, id=260, version=27412,

count=2, id=262, version=27412,

count=17, productName=Unmarked objects (old),

count=325, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=9, id=260, version=30154,

count=34, id=261, productName=VS2019 v16.11.6 build 30137, version=30137,

count=1, id=260, productName=VS2019 v16.11.6 build 30137, version=30137,

count=79, id=260, version=30158,

count=59, id=261, version=30154,

count=43, id=257, version=27412,

count=713, id=1, productName=Unmarked objects,

count=169, id=265, version=30157,

count=1, id=256, version=30157,

count=1, id=255, version=30157,

count=1, id=151,

count=1, id=258, version=30157,