2026-08-09_eece70e0e019db03a98ced7bfca17a68_glassworm_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_eece70e0e019db03a98ced7bfca17a68_glassworm_hijackloader_icedid_njrat_vidar
Size 1.0MB
Sample260809-s69dcs1cjg
SHA256 fdd5b22129cd04f1010d204f41a2d66feed85f67c09d3fe0d04ab3180759bef2
MD5 eece70e0e019db03a98ced7bfca17a68
SHA1 d94f043a85e791bb3344c22c8e578028c4b7fe04
SHA512 6c26d88cb9ad9b1ffef04f53228d492cdbbac6ffe3d05809530b260f704276e194fed08f41e19c9ac42c3471629ef961f36a85ceeb4c6dcd648fc1bb73450d46
SSDEEP 12288:jfyOgJVu17UVrUZlOHEv18jV/U89TBo+lfjfu:jfJYVCU10Ekv18jljTB3i
TLSH
T132354A56E39900EBE16782398B414976E6737C3E07354ADB0ED0B65B0E3B6904F39BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_eece70e0e019db03a98ced7bfca17a68_glassworm_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-09_eece70e0e019db03a98ced7bfca17a68_glassworm_hijackloader_icedid_njrat_vidar

.exe 1.0MB

2026-08-09_eece70e0e019db03a98ced7bfca17a68_glassworm_hijackloader_icedid_njrat_vidar

IMPHASH 64faf2a001353bbbc7c99d29a448ee09
SHA256 fdd5b22129cd04f1010d204f41a2d66feed85f67c09d3fe0d04ab3180759bef2
MD5 eece70e0e019db03a98ced7bfca17a68
SHA1 d94f043a85e791bb3344c22c8e578028c4b7fe04
SHA512 6c26d88cb9ad9b1ffef04f53228d492cdbbac6ffe3d05809530b260f704276e194fed08f41e19c9ac42c3471629ef961f36a85ceeb4c6dcd648fc1bb73450d46
SSDEEP 12288:jfyOgJVu17UVrUZlOHEv18jV/U89TBo+lfjfu:jfJYVCU10Ekv18jljTB3i
TLSH
T132354A56E39900EBE16782398B414976E6737C3E07354ADB0ED0B65B0E3B6904F39BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2a:0c:ef:ca:17:ad:c3:23:e9:94:34:2e:d2:80:4f:46:d1:86:d1:19:32:c7:d7:73:ec:8e:2e:b6:d4:a6:99:79

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=200510104M,CN=ACEVILLE PTE LTD,O=ACEVILLE PTE LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Jan 15, 2025

SERIALNUMBER=200510104M,CN=ACEVILLE PTE LTD,O=ACEVILLE PTE LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=200510104M,CN=ACEVILLE PTE LTD,O=ACEVILLE PTE LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=200510104M,CN=ACEVILLE PTE LTD,O=ACEVILLE PTE LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

04:2f:90:4e:97:f2:b4:3b:61:d2:14:5b:cf:e9:61:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 27, 2023 - Oct 26, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

162212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Landun\workspace\CommonComponent\ACE-Setup\1.compile_source\output\x64\ACE_Pub\ACE-Setup64.pdb

shlwapi

PathFileExistsW

kernel32

FindClose CreateDirectoryW SetFileAttributesW GetFileAttributesW FindNextFileW VerSetConditionMask LocalFree GetCurrentProcess GetNativeSystemInfo VerifyVersionInfoW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte HeapSize WriteConsoleW SetEndOfFile SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA GetUserDefaultLangID SetNamedPipeHandleState GetModuleHandleW LoadLibraryW GetProcAddress GetTickCount Sleep CreateFileW SetFilePointer ReadFile WriteFile GetFileSizeEx GetFileSize MoveFileExW CopyFileW GetTempPathW CreateProcessW GetModuleFileNameW OpenMutexW CloseHandle WaitForSingleObject GetLastError GetExitCodeProcess TerminateProcess GetLongPathNameW GetCommandLineW TryEnterCriticalSection FindFirstFileExA SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetCurrentThreadId EnterCriticalSection LeaveCriticalSection RtlUnwind DeleteCriticalSection FormatMessageW DeleteFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW SetLastError QueryPerformanceCounter InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SetEvent SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader RaiseException ExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle GetACP HeapAlloc HeapFree GetFileType

user32

EndDialog SendMessageW OemToCharBuffW DialogBoxParamW MessageBoxW

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW

ole32

CoTaskMemFree

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW StartServiceW SetServiceObjectSecurity EnumServicesStatusExW CreateServiceW ChangeServiceConfig2W GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegCloseKey QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW DeleteService ControlService OpenSCManagerW CloseServiceHandle

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_eece70e0e019db03a98ced7bfca17a68_glassworm_hijackloader_icedid_njrat_vidar

PE Signature issue

shlwapi

kernel32

user32

shell32

ole32

advapi32

wininet

version

generic