2026-08-21_5956f6659b0972a6b6816e15ed335560_chir_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_5956f6659b0972a6b6816e15ed335560_chir_glassworm_icedid_njrat_vidar
Size 3.5MB
Sample260821-e6jaaagm7t
SHA256 ad8cc157e43d44806c0b4904b4673f488696472d1c9de71de5047de1dda1c0fb
MD5 5956f6659b0972a6b6816e15ed335560
SHA1 c323b92d2e0fcdd068c74909cb94e04babc96f1e
SHA512 0a91f829cb6fd9125d70be362fdf64e66bbb1d1b6d53879e542349f3ba0003e7a9f575c957b84a4c8b5c99f31551e92a4c9bf5c08f899b1a92741a6b028ae299
SSDEEP 49152:pjPJJsMg0UMp2viAEk2qtFoLuzO7ge9fDqgs16IQsUToEm:NP/0mpEeqgsMIQsUTXm
TLSH
T12BF57C6576EC80D4C466D934C54B8917DAF2BC520931C78F40ADDA8F2F3B1620E7AB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-21_5956f6659b0972a6b6816e15ed335560_chir_glassworm_icedid_njrat_vidar

File Explorer

2026-08-21_5956f6659b0972a6b6816e15ed335560_chir_glassworm_icedid_njrat_vidar

.exe 3.5MB

2026-08-21_5956f6659b0972a6b6816e15ed335560_chir_glassworm_icedid_njrat_vidar

IMPHASH 74401e04f2f0d2a50fa88f282dfff6b7
SHA256 ad8cc157e43d44806c0b4904b4673f488696472d1c9de71de5047de1dda1c0fb
MD5 5956f6659b0972a6b6816e15ed335560
SHA1 c323b92d2e0fcdd068c74909cb94e04babc96f1e
SHA512 0a91f829cb6fd9125d70be362fdf64e66bbb1d1b6d53879e542349f3ba0003e7a9f575c957b84a4c8b5c99f31551e92a4c9bf5c08f899b1a92741a6b028ae299
SSDEEP 49152:pjPJJsMg0UMp2viAEk2qtFoLuzO7ge9fDqgs16IQsUToEm:NP/0mpEeqgsMIQsUTXm
TLSH
T12BF57C6576EC80D4C466D934C54B8917DAF2BC520931C78F40ADDA8F2F3B1620E7AB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

99:3f:37:1e:4c:7a:cc:5f:95:8c:a7:c0:14:92:bf:a7:aa:dc:e6:9a:63:b9:a2:b9:99:02:26:9f:bc:26:5c:32

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 27, 2021

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

6f:e8:ca:45:27:e9:e6:f5:31:b8:68:9a:f4:3b:95:43:f0:bc:e6:da

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Mar 24, 2021

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

0b:fc:fa:c0:8e:21:6a:1c:1f:da:a6:b7:7b:b2:d6:6e

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 6, 2020 - Jan 6, 2022

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2020 - Dec 2, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F7A6-E251-150A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:59:9f:fc:7e:5f:2c:ea:f2:43:00:00:00:00:01:59

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 14, 2021 - Apr 11, 2022

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

1077334297

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\proj_20210312_BackgroundProcess_huawei\296_modify\RtHDVBgProc\_MA4_release\x64\RtHDVBgProc.pdb

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

propsys

PropVariantToUInt32 PropVariantCompareEx

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

version

GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetProfileIntW GetTempPathW VerifyVersionInfoW VerSetConditionMask GetTickCount GetWindowsDirectoryW lstrcpyW GetCurrentDirectoryW SetErrorMode SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc FileTimeToSystemTime GetEnvironmentStringsW GlobalGetAtomNameW GetCurrentThread SuspendThread SetThreadPriority GetTempFileNameW RtlUnwindEx RtlPcToFileHeader VirtualAlloc ExitThread FreeLibraryAndExitThread GetCommandLineA GetCommandLineW HeapQueryInformation QueryPerformanceFrequency SetStdHandle GetFileType GetStdHandle ExitProcess GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW LCMapStringW GetTimeZoneInformation FindFirstFileExW GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetThreadLocale lstrcmpiW WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo DeleteFileW CompareStringW QueryActCtxW SearchPathW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW GetModuleHandleExW GetModuleFileNameW FreeResource EncodePointer OutputDebugStringA lstrcmpA SetLastError CopyFileW FormatMessageW MulDiv GlobalSize LoadLibraryExA VirtualQuery VirtualProtect LocalAlloc LocalFree GetProcessHeap DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize HeapFree GetFileAttributesW GetFirmwareEnvironmentVariableA CreateMutexW GetExitCodeThread ResumeThread DuplicateHandle InitializeCriticalSectionAndSpinCount MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection OutputDebugStringW FreeLibrary LoadLibraryW FindResourceExW GetSystemInfo GetUserDefaultUILanguage GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects SetEvent CreateThread CreateEventW Sleep QueryFullProcessImageNameW GetVersionExW WaitForSingleObject CreateProcessW GetSystemDirectoryW GetSystemDirectoryA WideCharToMultiByte DeviceIoControl CreateFileW CloseHandle GetCurrentProcess OpenProcess GetModuleHandleA GetModuleHandleW GetProcAddress GetLastError InitializeCriticalSectionEx LeaveCriticalSection GetCurrentThreadId EnterCriticalSection FindResourceW LoadResource LockResource SizeofResource FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW WriteConsoleW

user32

CopyIcon SetCursorPos GetSystemMenu IsZoomed DrawFrameControl DrawEdge DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetParent SetWindowRgn SetClassLongPtrW EnumDisplayMonitors SetLayeredWindowAttributes GetKeyNameTextW InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx RegisterClipboardFormatW ReuseDDElParam UnpackDDElParam InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW BringWindowToTop GetMenuDefaultItem CreatePopupMenu LoadImageW TrackMouseEvent DestroyIcon MessageBeep GetNextDlgGroupItem IsRectEmpty InvalidateRgn CopyAcceleratorTableW CharNextW DeleteMenu WindowFromPoint ReleaseCapture WaitMessage GetAsyncKeyState CopyImage GetMenuItemInfoW DestroyMenu RealChildWindowFromPoint LoadCursorW OffsetRect SetRectEmpty SendDlgItemMessageA SetCursor ShowOwnedPopups MapDialogRect SetWindowContextHelpId GetNextDlgTabItem EndDialog CreateDialogIndirectParamW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem LoadMenuW GetCursorPos GetActiveWindow GetMessageW IsDialogMessageW FrameRect CheckDlgButton MoveWindow IsWindowEnabled GetSystemMetrics IntersectRect GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetLastActivePopup GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect EqualRect MapWindowPoints MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW DrawMenuBar CreateMenu ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ValidateRect SetActiveWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu IsWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos FillRect ScreenToClient DrawIcon UnionRect PostThreadMessageW UpdateLayeredWindow MonitorFromPoint GetComboBoxInfo GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ClientToScreen EndPaint ModifyMenuW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DestroyCursor GetWindowRgn SetWindowTextW BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW LoadIconW IsWindowVisible UnregisterClassW DispatchMessageW TranslateMessage PostQuitMessage PeekMessageW SendInput MapVirtualKeyW EnumDisplaySettingsW CallNextHookEx UnregisterDeviceNotification RegisterDeviceNotificationW KillTimer ChangeWindowMessageFilter SetTimer FindWindowExW RegisterWindowMessageW CharUpperW SetWindowPos NotifyWinEvent DrawFocusRect InflateRect CopyRect DrawTextW SendMessageW SetRect RedrawWindow GetSysColorBrush EnableWindow GetDesktopWindow GetWindow UnregisterPowerSettingNotification RegisterPowerSettingNotification UnhookWindowsHookEx SetWindowsHookExW GetSysColor GetClientRect GetParent GetWindowRect EnumThreadWindows InvalidateRect SetForegroundWindow GetForegroundWindow GetWindowThreadProcessId UpdateWindow ShowWindow GetWindowLongW SystemParametersInfoW PostMessageW SubtractRect TranslateMDISysAccel DefMDIChildProcW SetPropW DefFrameProcW GetPropW SetCapture

gdi32

MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CombineRgn CreateFontIndirectW CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextExtentPoint32W GetTextMetricsW GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW SetROP2 SetPolyFillMode GetMapMode CreateCompatibleBitmap GetObjectW SetDIBColorTable DeleteObject CreateDIBSection CreateFontW SelectObject BitBlt CreateCompatibleDC DeleteDC SetTextAlign StretchBlt GetViewportExtEx GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW SetTextColor GetWindowExtEx GetStockObject

msimg32

TransparentBlt AlphaBlend

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegDeleteValueW RegOpenKeyExW RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegNotifyChangeKeyValue RegQueryValueExW RegSetValueExW RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage SHBrowseForFolderW DragFinish DragQueryFileW SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathIsUNCW StrFormatKBSizeW PathRemoveFileSpecW PathFindFileNameW PathStripToRootW

uxtheme

GetThemeSysColor CloseThemeData OpenThemeData DrawThemeText DrawThemeBackground DrawThemeParentBackground GetWindowTheme IsAppThemed GetThemePartSize IsThemeBackgroundPartiallyTransparent GetCurrentThemeName GetThemeColor

ole32

CoGetClassObject CoDisconnectObject CLSIDFromProgID CoCreateGuid ReleaseStgMedium OleDuplicateData StgOpenStorageOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries OleInitialize OleUninitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor StgCreateDocfileOnILockBytes PropVariantCopy FreePropVariantArray OleTranslateAccelerator IsAccelerator CoFreeUnusedLibrariesEx CoInitialize CreateStreamOnHGlobal CoTaskMemAlloc StringFromGUID2 CLSIDFromString PropVariantClear CoTaskMemFree CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoUninitialize CoInitializeEx

oleaut32

OleCreateFontIndirect LoadTypeLi VarBstrFromDate SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VariantInit VariantChangeType GetErrorInfo VariantCopy SysAllocStringLen SafeArrayPutElement SafeArrayCreateVector SysFreeString SafeArrayUnaccessData SafeArrayAccessData SysAllocString VariantClear

oledlg

OleUIBusyW

gdiplus

GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipDrawImageI GdipSetInterpolationMode GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipFree GdiplusShutdown

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_5956f6659b0972a6b6816e15ed335560_chir_glassworm_icedid_njrat_vidar

PE Signature issue

PE Signature issue

wtsapi32

propsys

setupapi

version

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

generic