2026-08-21_6d400e653eeecc42d0b127c51a9da126_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_6d400e653eeecc42d0b127c51a9da126_cobalt-strike_glassworm_icedid_njrat_vidar
Size 14.7MB
Sample260821-e2cxpsgl9x
SHA256 ac93eb5ba52b7d4ee0a9c6d0d02b0d574abaf93b96f4191d29f94e144cb8ada4
MD5 6d400e653eeecc42d0b127c51a9da126
SHA1 cf3794e1f43b12983cebe81627456a8ebc6f5c0e
SHA512 0cf2ce43a1b6f9c01b30c5505a2d4fcca83554631a9a3d541a3c419ae870fc2b9000af5415986ceccbda230b252c65f8a8fcd5ac8c2aa1eede3c5eb9e2de9e8b
SSDEEP 393216:kiWo3b9hOM5uGZojXWuuaZ81QUcqNAT3PzSGiD:LWGhOfGdaZbtke3PsD
TLSH
T19AF6136D625433ACC01FC4789433A945F2B6341F1BB496EF33E6A6C02B7B5D09A76B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_6d400e653eeecc42d0b127c51a9da126_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-08-21_6d400e653eeecc42d0b127c51a9da126_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 14.7MB

2026-08-21_6d400e653eeecc42d0b127c51a9da126_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 2be743912e28fb4c87c299d6850a6be4
SHA256 ac93eb5ba52b7d4ee0a9c6d0d02b0d574abaf93b96f4191d29f94e144cb8ada4
MD5 6d400e653eeecc42d0b127c51a9da126
SHA1 cf3794e1f43b12983cebe81627456a8ebc6f5c0e
SHA512 0cf2ce43a1b6f9c01b30c5505a2d4fcca83554631a9a3d541a3c419ae870fc2b9000af5415986ceccbda230b252c65f8a8fcd5ac8c2aa1eede3c5eb9e2de9e8b
SSDEEP 393216:kiWo3b9hOM5uGZojXWuuaZ81QUcqNAT3PzSGiD:LWGhOfGdaZbtke3PsD
TLSH
T19AF6136D625433ACC01FC4789433A945F2B6341F1BB496EF33E6A6C02B7B5D09A76B12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13568829

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptAcquireContextA

crypt32

CryptProtectData

ws2_32

__WSAFDIsSet

wldap32

ord45

normaliz

IdnToAscii

kernel32

TerminateProcess FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

CloseClipboard GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

msvcp140

_Thrd_join

imm32

ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlImageNtHeader

winhttp

WinHttpSendRequest

d3d9

Direct3DCreate9

gdiplus

GdipGetImageHeight

vcruntime140

memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-stdio-l1-1-0

fwrite

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

Name

.text

Size

824KB

Virtual Size

828KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

199KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

429KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_6d400e653eeecc42d0b127c51a9da126_cobalt-strike_glassworm_icedid_njrat_vidar

advapi32

crypt32

ws2_32

wldap32

normaliz

kernel32

user32

gdi32

shell32

ole32

msvcp140

imm32

dwmapi

ntdll

winhttp

d3d9

gdiplus

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

generic