General
- Target 2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar
- Size 39.2MB
- Sample260812-e79tmaae45
- SHA256 011fa0f7b869f68441b935997374de40b5e6d89349a185ba5f519588f51a86f2
- MD5 5c9246b3def74e832db064ff80b5e291
- SHA1 e66bcfe23f03bbb11504a39bdbb58a7cbd9e334e
- SHA512 a5c8f9b5e82cdf0f706dd660ecebec506257b822d603450edf2b3cd965be813296b4b66ac05707228cd2d0eedcb8bdf1e10e5b8bd133f2b0e9558e67f2c407f9
- SSDEEP 786432:6PrmBARiya61+8Lnhcu4fY+7qK3dNKvaF:6PMGLh14f52K3/Kv
- TLSH T18C975A13B6A8BDD2E0314234A7BF8BF0D759DC259608C25F10853BDB7E3E6827D552A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar
- Size 39.2MB
- SHA256 011fa0f7b869f68441b935997374de40b5e6d89349a185ba5f519588f51a86f2
- MD5 5c9246b3def74e832db064ff80b5e291
- SHA1 e66bcfe23f03bbb11504a39bdbb58a7cbd9e334e
- SHA512 a5c8f9b5e82cdf0f706dd660ecebec506257b822d603450edf2b3cd965be813296b4b66ac05707228cd2d0eedcb8bdf1e10e5b8bd133f2b0e9558e67f2c407f9
- SSDEEP 786432:6PrmBARiya61+8Lnhcu4fY+7qK3dNKvaF:6PMGLh14f52K3/Kv
- TLSH T18C975A13B6A8BDD2E0314234A7BF8BF0D759DC259608C25F10853BDB7E3E6827D552A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables Discord URL observed in first stage droppers
-
Detects executables packed with VMProtect.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL