2026-08-03_b11d83acffa66f73ed7f5a96a9051595_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_b11d83acffa66f73ed7f5a96a9051595_glassworm_icedid_njrat_vidar
Size 6.7MB
Sample260804-l8h6maxele
SHA256 c3a4f509b8177c21cc1fc0ff134d900eb4579c3a73b9dbc7b45b21134948631f
MD5 b11d83acffa66f73ed7f5a96a9051595
SHA1 12d7798b01b885d64150df2648b4b378740367e1
SHA512 94913da57f7f09ab46946efe33dfbb3b9c89b15522f9171c3fac0f3755b4802ba865c8ba5a0093ba009e8597d417c3359756135c1612a0d6d26fe1621a859382
SSDEEP 49152:GozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs86:G1MbQ9yDAD7KjjqkusjmqMh
TLSH
T14C665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_b11d83acffa66f73ed7f5a96a9051595_glassworm_icedid_njrat_vidar

File Explorer

2026-08-03_b11d83acffa66f73ed7f5a96a9051595_glassworm_icedid_njrat_vidar

.exe 6.7MB

2026-08-03_b11d83acffa66f73ed7f5a96a9051595_glassworm_icedid_njrat_vidar

IMPHASH 91b6dee46d1e9cb862048488e244bc70
SHA256 c3a4f509b8177c21cc1fc0ff134d900eb4579c3a73b9dbc7b45b21134948631f
MD5 b11d83acffa66f73ed7f5a96a9051595
SHA1 12d7798b01b885d64150df2648b4b378740367e1
SHA512 94913da57f7f09ab46946efe33dfbb3b9c89b15522f9171c3fac0f3755b4802ba865c8ba5a0093ba009e8597d417c3359756135c1612a0d6d26fe1621a859382
SSDEEP 49152:GozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs86:G1MbQ9yDAD7KjjqkusjmqMh
TLSH
T14C665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6942848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\Integrator.pdb

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegSetValueExW RegQueryValueExW EventWriteTransfer EventRegister EventUnregister RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority AllocateAndInitializeSid FreeSid EqualSid OpenProcessToken CreateWellKnownSid RevertToSelf OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW ChangeServiceConfigW GetLengthSid CopySid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertSidToStringSidA CheckTokenMembership RegNotifyChangeKeyValue EventWrite RegGetValueA SetNamedSecurityInfoW GetSecurityDescriptorControl SetEntriesInAclW BuildTrusteeWithSidW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress GetModuleHandleExW K32GetProcessMemoryInfo GlobalMemoryStatusEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock GetCurrentProcessId FileTimeToSystemTime GetUserDefaultLocaleName IsValidCodePage SetLastError WideCharToMultiByte GetSystemTime SystemTimeToFileTime GetCPInfoExW CreateEventExW GetStringTypeW RaiseException LoadLibraryExW GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetVersionExW GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource OpenProcess GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW FormatMessageW FormatMessageA LocalFree GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW CreateActCtxW ActivateActCtx HeapFree OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc GetProcessHeap ReleaseMutex OpenMutexW WaitForSingleObjectEx lstrlenW GetPriorityClass GetExitCodeProcess ProcessIdToSessionId GetCurrentThread GetExitCodeThread WaitForMultipleObjects WaitForMultipleObjectsEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace MapViewOfFile ReadFile SetFilePointerEx GetFileSizeEx GetTempPathW GetTempFileNameW GetTickCount SetEvent CreateDirectoryW FindNextFileW FindFirstFileW lstrcmpW RemoveDirectoryW CopyFileW GetFileAttributesW CreateFileMappingW FlushViewOfFile GetFileType SetEndOfFile SetFilePointer GetOverlappedResult UnlockFile LockFile SetFileInformationByHandle GetFileInformationByHandleEx GetLongPathNameW GetFullPathNameW CreateMutexW ReleaseSemaphore OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA GlobalFree LocalAlloc DeleteFileA GetTempPathA GetCommandLineW SetEnvironmentVariableW GetTimeZoneInformation IsValidLocale CreateEventW WaitForSingleObject CreateThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo LockResource FlushFileBuffers CancelIoEx WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree VirtualAlloc LCMapStringEx LCIDToLocaleName LocaleNameToLCID GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread DecodePointer AreFileApisANSI HeapCreate GetDiskFreeSpaceW InitializeCriticalSection GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetDiskFreeSpaceA GetFileAttributesA HeapReAlloc HeapCompact HeapDestroy LockFileEx GetSystemDefaultLCID GetLocalTime LoadLibraryExA VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SetStdHandle EnumSystemLocalesW GetTimeFormatW GetDateFormatW GetCommandLineA ExitProcess GetStdHandle ExitThread GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer GetFileSize CreateFileMappingA CloseHandle CreateFileA UnmapViewOfFile CreateTimerQueueTimer GetUserGeoID FindFirstFileExW FindClose SetFileAttributesW DeleteFileW GetModuleFileNameW MultiByteToWideChar GetStringTypeExW GetFileAttributesExW ExpandEnvironmentStringsW IsWow64Process CompareStringEx GetLastError GlobalAlloc Sleep GetCurrentProcess WriteFile RtlUnwind

ole32

IIDFromString CoCreateInstance CoSetProxyBlanket CoTaskMemFree CLSIDFromString StringFromGUID2 CoCreateGuid CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemAlloc CreateStreamOnHGlobal CoRevokeInitializeSpy CoInitialize CoUninitialize CoRegisterInitializeSpy

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

wintrust

WintrustAddActionID WintrustRemoveActionID

iphlpapi

GetAdaptersInfo

gdi32

GetDeviceCaps

winspool.drv

AddPrinterW DeletePrinter XcvDataW OpenPrinterW DeletePrinterDriverExW ClosePrinter InstallPrinterDriverFromPackageW UploadPrinterDriverPackageW

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.prot

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_b11d83acffa66f73ed7f5a96a9051595_glassworm_icedid_njrat_vidar

advapi32

kernel32

ole32

oleaut32

wintrust

iphlpapi

gdi32

winspool.drv

generic