2026-08-03_180d54d6fbf9864a7420e8483ac26ebb_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_180d54d6fbf9864a7420e8483ac26ebb_glassworm_icedid_njrat_vidar
Size 6.7MB
Sample260804-p6mmtabc39
SHA256 8883f2c1e1a2d721f375a027d203c906df79701f2facffa2d511c579007898d2
MD5 180d54d6fbf9864a7420e8483ac26ebb
SHA1 9c262e1b748e42da0adc793140a136bd51b1b3fe
SHA512 6e0b303cb9797cc0fc4bab020905c08e807370061200b1c3e5d23d5838476cb9e165e7993540abf72f9af1859a4f5540e982394cd4529d878f8589315e3bf14b
SSDEEP 49152:GozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8E:G1MbQ9yDAD7KjjqkusjmqMh
TLSH
T15A665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_180d54d6fbf9864a7420e8483ac26ebb_glassworm_icedid_njrat_vidar

File Explorer

2026-08-03_180d54d6fbf9864a7420e8483ac26ebb_glassworm_icedid_njrat_vidar

.exe 6.7MB

2026-08-03_180d54d6fbf9864a7420e8483ac26ebb_glassworm_icedid_njrat_vidar

IMPHASH 91b6dee46d1e9cb862048488e244bc70
SHA256 8883f2c1e1a2d721f375a027d203c906df79701f2facffa2d511c579007898d2
MD5 180d54d6fbf9864a7420e8483ac26ebb
SHA1 9c262e1b748e42da0adc793140a136bd51b1b3fe
SHA512 6e0b303cb9797cc0fc4bab020905c08e807370061200b1c3e5d23d5838476cb9e165e7993540abf72f9af1859a4f5540e982394cd4529d878f8589315e3bf14b
SSDEEP 49152:GozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8E:G1MbQ9yDAD7KjjqkusjmqMh
TLSH
T15A665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6942848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\Integrator.pdb

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegSetValueExW RegQueryValueExW EventWriteTransfer EventRegister EventUnregister RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority AllocateAndInitializeSid FreeSid EqualSid OpenProcessToken CreateWellKnownSid RevertToSelf OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW ChangeServiceConfigW GetLengthSid CopySid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertSidToStringSidA CheckTokenMembership RegNotifyChangeKeyValue EventWrite RegGetValueA SetNamedSecurityInfoW GetSecurityDescriptorControl SetEntriesInAclW BuildTrusteeWithSidW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress GetModuleHandleExW K32GetProcessMemoryInfo GlobalMemoryStatusEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock GetCurrentProcessId FileTimeToSystemTime GetUserDefaultLocaleName IsValidCodePage SetLastError WideCharToMultiByte GetSystemTime SystemTimeToFileTime GetCPInfoExW CreateEventExW GetStringTypeW RaiseException LoadLibraryExW GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetVersionExW GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource OpenProcess GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW FormatMessageW FormatMessageA LocalFree GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW CreateActCtxW ActivateActCtx HeapFree OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc GetProcessHeap ReleaseMutex OpenMutexW WaitForSingleObjectEx lstrlenW GetPriorityClass GetExitCodeProcess ProcessIdToSessionId GetCurrentThread GetExitCodeThread WaitForMultipleObjects WaitForMultipleObjectsEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace MapViewOfFile ReadFile SetFilePointerEx GetFileSizeEx GetTempPathW GetTempFileNameW GetTickCount SetEvent CreateDirectoryW FindNextFileW FindFirstFileW lstrcmpW RemoveDirectoryW CopyFileW GetFileAttributesW CreateFileMappingW FlushViewOfFile GetFileType SetEndOfFile SetFilePointer GetOverlappedResult UnlockFile LockFile SetFileInformationByHandle GetFileInformationByHandleEx GetLongPathNameW GetFullPathNameW CreateMutexW ReleaseSemaphore OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA GlobalFree LocalAlloc DeleteFileA GetTempPathA GetCommandLineW SetEnvironmentVariableW GetTimeZoneInformation IsValidLocale CreateEventW WaitForSingleObject CreateThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo LockResource FlushFileBuffers CancelIoEx WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree VirtualAlloc LCMapStringEx LCIDToLocaleName LocaleNameToLCID GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread DecodePointer AreFileApisANSI HeapCreate GetDiskFreeSpaceW InitializeCriticalSection GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetDiskFreeSpaceA GetFileAttributesA HeapReAlloc HeapCompact HeapDestroy LockFileEx GetSystemDefaultLCID GetLocalTime LoadLibraryExA VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SetStdHandle EnumSystemLocalesW GetTimeFormatW GetDateFormatW GetCommandLineA ExitProcess GetStdHandle ExitThread GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer GetFileSize CreateFileMappingA CloseHandle CreateFileA UnmapViewOfFile CreateTimerQueueTimer GetUserGeoID FindFirstFileExW FindClose SetFileAttributesW DeleteFileW GetModuleFileNameW MultiByteToWideChar GetStringTypeExW GetFileAttributesExW ExpandEnvironmentStringsW IsWow64Process CompareStringEx GetLastError GlobalAlloc Sleep GetCurrentProcess WriteFile RtlUnwind

ole32

IIDFromString CoCreateInstance CoSetProxyBlanket CoTaskMemFree CLSIDFromString StringFromGUID2 CoCreateGuid CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemAlloc CreateStreamOnHGlobal CoRevokeInitializeSpy CoInitialize CoUninitialize CoRegisterInitializeSpy

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

wintrust

WintrustAddActionID WintrustRemoveActionID

iphlpapi

GetAdaptersInfo

gdi32

GetDeviceCaps

winspool.drv

AddPrinterW DeletePrinter XcvDataW OpenPrinterW DeletePrinterDriverExW ClosePrinter InstallPrinterDriverFromPackageW UploadPrinterDriverPackageW

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.prot

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_180d54d6fbf9864a7420e8483ac26ebb_glassworm_icedid_njrat_vidar

advapi32

kernel32

ole32

oleaut32

wintrust

iphlpapi

gdi32

winspool.drv

generic