2026-08-07_6006ec9768a414df9d597cb838b1ef1e_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_6006ec9768a414df9d597cb838b1ef1e_glassworm_icedid_njrat_vidar
Size 2.7MB
Sample260807-gp2fmsgq7w
SHA256 73da9e4b83711419b453341577160aebf965dae8cf0317e789b190551571d146
MD5 6006ec9768a414df9d597cb838b1ef1e
SHA1 2b5f7bd3cea7315522f980b9757e8605e228e47e
SHA512 99bd0591bf90aa418b72f50bd11b4bc45ec6f38655eb23e94a75c6b541904c41680e65b2984426980caaed7e965305835c8d9d08ed6f6297feecdf7ad70bd451
SSDEEP 49152:NuT1s74BhQ/dLL7ZE03GboLWvHMQ/lFTjN4:96SkLm
TLSH
T12BD5080237F90B9DF2F78B789576A2129876BC2D9B11D7EE2264400D1E22BD08D75B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_6006ec9768a414df9d597cb838b1ef1e_glassworm_icedid_njrat_vidar

File Explorer

2026-08-07_6006ec9768a414df9d597cb838b1ef1e_glassworm_icedid_njrat_vidar

.exe 2.7MB

2026-08-07_6006ec9768a414df9d597cb838b1ef1e_glassworm_icedid_njrat_vidar

IMPHASH f763935d461cd72fc0206cd182cd2093
SHA256 73da9e4b83711419b453341577160aebf965dae8cf0317e789b190551571d146
MD5 6006ec9768a414df9d597cb838b1ef1e
SHA1 2b5f7bd3cea7315522f980b9757e8605e228e47e
SHA512 99bd0591bf90aa418b72f50bd11b4bc45ec6f38655eb23e94a75c6b541904c41680e65b2984426980caaed7e965305835c8d9d08ed6f6297feecdf7ad70bd451
SSDEEP 49152:NuT1s74BhQ/dLL7ZE03GboLWvHMQ/lFTjN4:96SkLm
TLSH
T12BD5080237F90B9DF2F78B789576A2129876BC2D9B11D7EE2264400D1E22BD08D75B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

711072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf.pdb

kernel32

HeapSize GetStringTypeW OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentThreadId GetThreadId GetSystemPowerStatus GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WideCharToMultiByte GetTimeZoneInformation GetFileAttributesExW GetFileSizeEx SetFilePointerEx SetEndOfFile GetTickCount64 RaiseException OutputDebugStringA WaitForMultipleObjects WriteConsoleW GetConsoleCP CreateFileA DeviceIoControl ReadConsoleW GetEnvironmentVariableA GetTempPathW FormatMessageA SetLastError CreateMutexA CreateMutexW SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW ReleaseMutex LocalFree GetStdHandle GetCommandLineW TerminateProcess GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW AddDllDirectory SetDllDirectoryW WriteConsoleInputW GetConsoleMode SetStdHandle GetFullPathNameW GetCurrentDirectoryW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary GetLastError AcquireSRWLockShared ReleaseSRWLockShared GetFileAttributesA FindNextFileA FindFirstFileA FindClose QueryPerformanceFrequency WTSGetActiveConsoleSessionId RtlUnwind SetCurrentDirectoryW CreateDirectoryW DeleteFileW RemoveDirectoryW CopyFileW QueryPerformanceCounter CreateThread GetCurrentProcess CreateSemaphoreW Sleep CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock DuplicateHandle GetTempPathA HeapReAlloc MoveFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW CloseHandle TlsFree TlsSetValue TlsGetValue TlsAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent __C_specific_handler EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA HeapFree HeapAlloc GetCurrentThread MultiByteToWideChar InitializeCriticalSectionAndSpinCount

powrprof

PowerReadACValueIndex PowerReadDCValueIndex SetSuspendState PowerWriteSettingAttributes PowerRemovePowerSetting

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsGetStringRawBuffer WindowsCompareStringOrdinal WindowsDuplicateString WindowsCreateStringReference WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ole32

CoCreateInstance CoIncrementMTAUsage PropVariantClear CoDecrementMTAUsage StringFromCLSID CoInitializeEx CoTaskMemFree CoUninitialize

api-ms-win-power-setting-l1-1-0

PowerWriteACValueIndex PowerGetActiveScheme PowerSetActiveScheme PowerSettingRegisterNotification PowerSettingUnregisterNotification PowerWriteDCValueIndex

advapi32

EventWrite EventUnregister EventRegister StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W SetTokenInformation DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce AddAccessAllowedAce LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ControlTraceW CloseTrace ProcessTrace OpenTraceW EnableTraceEx StartTraceW

tdh

TdhGetEventInformation

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_Registry_PropertyW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Locate_DevNodeW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

926KB

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_6006ec9768a414df9d597cb838b1ef1e_glassworm_icedid_njrat_vidar

kernel32

powrprof

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

ole32

api-ms-win-power-setting-l1-1-0

advapi32

tdh

api-ms-win-power-base-l1-1-0

userenv

api-ms-win-devices-config-l1-1-1

generic