2026-08-22_ed46597d6b1617fe658034a11b87824e_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_ed46597d6b1617fe658034a11b87824e_glassworm_icedid_njrat
Size 35.2MB
Sample260822-1pv4eacl3s
SHA256 14d71de21346dff0fa2f00e37d1a2c57548d3b16f5005a61b5164bce5aa4a765
MD5 ed46597d6b1617fe658034a11b87824e
SHA1 8b9c5b48c9c1d28910cbced4e104e43825d3eecf
SHA512 9c4a3fa76c6d72306e416bbbaeb2812ce249e1acc55f0c52f13de496dddb64ff75e336e193cb595b8825b6b528b5b57640296b68c44f1f9b8d9876fbff893434
SSDEEP 98304:dbMTiA94Z5xmDTwFMA+NyEf8s2o56pLdomQTyACgFnU:RoK4DTuOy6/2oUdo1LCgi
TLSH
T1A6876546A7BD4196E3FBC435AA52851AFCB37893CB78D7CB81510A0A1722FE4DD39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_ed46597d6b1617fe658034a11b87824e_glassworm_icedid_njrat

File Explorer

2026-08-22_ed46597d6b1617fe658034a11b87824e_glassworm_icedid_njrat

.exe 35.2MB

2026-08-22_ed46597d6b1617fe658034a11b87824e_glassworm_icedid_njrat

IMPHASH d0a214df0e1889ba603ff0097509f50e
SHA256 14d71de21346dff0fa2f00e37d1a2c57548d3b16f5005a61b5164bce5aa4a765
MD5 ed46597d6b1617fe658034a11b87824e
SHA1 8b9c5b48c9c1d28910cbced4e104e43825d3eecf
SHA512 9c4a3fa76c6d72306e416bbbaeb2812ce249e1acc55f0c52f13de496dddb64ff75e336e193cb595b8825b6b528b5b57640296b68c44f1f9b8d9876fbff893434
SSDEEP 98304:dbMTiA94Z5xmDTwFMA+NyEf8s2o56pLdomQTyACgFnU:RoK4DTuOy6/2oUdo1LCgi
TLSH
T1A6876546A7BD4196E3FBC435AA52851AFCB37893CB78D7CB81510A0A1722FE4DD39702
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9803064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Demian\Projects\CIS\CIS_UM\_out\Debug\x64\Symbols\cfpconfg.pdb

kernel32

RemoveDirectoryW SetFileAttributesW lstrcpyW TerminateProcess MoveFileExW SystemTimeToFileTime FlushFileBuffers FreeLibrary GetFileAttributesW K32EnumProcesses FileTimeToDosDateTime LoadLibraryW GetModuleFileNameW DeviceIoControl SetUnhandledExceptionFilter FileTimeToLocalFileTime OpenProcess RaiseException DecodePointer Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteFile CreateFileW WideCharToMultiByte MultiByteToWideChar LeaveCriticalSection EnterCriticalSection VerifyVersionInfoW CopyFileW UnmapViewOfFile GetSystemTime GetCurrentThreadId DeleteFileW VerSetConditionMask FormatMessageW LocalAlloc MapViewOfFileEx CreateFileMappingW CreateEventW SetEvent SetProcessWorkingSetSize GetExitCodeProcess CreateMutexW WaitForSingleObject FindResourceW GetThreadContext SuspendThread OpenThread OpenMutexA FlushViewOfFile GetVersion CreateMutexA SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP HeapQueryInformation EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW IsThreadAFiber SetConsoleCtrlHandler ExitProcess GetTimeZoneInformation ExitThread WriteConsoleW GetCommandLineA SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW GetSystemTimeAsFileTime LocalFree ProcessIdToSessionId GetCurrentProcessId GetCurrentProcess Sleep DeleteCriticalSection InitializeCriticalSectionEx SetLastError GetLastError CloseHandle GetCommandLineW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy InitializeCriticalSectionAndSpinCount RtlUnwindEx VirtualQuery GetStartupInfoW UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext WaitForMultipleObjectsEx CreateTimerQueue SetProcessAffinityMask VirtualFree VirtualProtect VirtualAlloc GetVersionExW UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree GetThreadPriority SetThreadPriority SignalObjectAndWait FreeLibraryAndExitThread GetThreadTimes RegisterWaitForSingleObject UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetTickCount64 ExpandEnvironmentStringsW SearchPathW GetDriveTypeW GetFileInformationByHandle GetLongPathNameW GetTempFileNameW GetTempPathW TlsAlloc TlsGetValue TlsSetValue GetSystemDirectoryW GetWindowsDirectoryW QueryFullProcessImageNameW K32GetModuleFileNameExW K32GetProcessImageFileNameW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceW GetFileSize GetFileTime ReadFile GetCompressedFileSizeW GetComputerNameW SetFilePointer OutputDebugStringW QueryPerformanceFrequency ReleaseMutex GetLocalTime OpenEventW GetProcessTimes GetCurrentThread ResumeThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute ReadProcessMemory AssignProcessToJobObject K32EnumProcessModules ReleaseSemaphore SystemTimeToTzSpecificLocalTime FileTimeToSystemTime MoveFileW GetSystemInfo GetSystemWindowsDirectoryW GetGeoInfoW GetUserGeoID CreateDirectoryW GetSystemDefaultUILanguage GetSystemDefaultLangID GetTickCount GetNativeSystemInfo lstrcmpA GlobalAlloc GlobalUnlock GlobalLock GlobalFree FreeResource GetFileSizeEx OutputDebugStringA QueryDosDeviceW GetUserDefaultLangID OpenSemaphoreW CreateSemaphoreW MapViewOfFile GetUserDefaultLCID SetEndOfFile SetFileTime SetCurrentDirectoryW GetCurrentDirectoryW FindCloseChangeNotification FindFirstChangeNotificationW GetLogicalDriveStringsW GetModuleHandleA CompareFileTime GetStdHandle GetFileType DuplicateHandle DosDateTimeToFileTime LocalFileTimeToFileTime TzSpecificLocalTimeToSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetThreadLocale GetDiskFreeSpaceExW GlobalMemoryStatus K32EnumDeviceDrivers K32GetDeviceDriverFileNameW SetFileInformationByHandle QueryPerformanceCounter FormatMessageA LockFileEx CreateFileMappingA UnlockFile HeapCompact DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetComputerNameExW OpenMutexW CreateThread TerminateThread GetExitCodeThread GetPrivateProfileStringW GetPrivateProfileSectionNamesW ResetEvent WaitForMultipleObjects PulseEvent SetThreadLocale GetVolumeInformationW GetFileInformationByHandleEx LoadLibraryExW EnumResourceNamesW IsDebuggerPresent GetStringTypeW InitOnceBeginInitialize InitOnceComplete FindFirstFileExW GetFinalPathNameByHandleW SetFilePointerEx CreateDirectoryExW CreateHardLinkW CreateSymbolicLinkW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SwitchToThread GetLocaleInfoEx InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW RtlPcToFileHeader FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber RtlUnwind

user32

EmptyClipboard IsCharAlphaNumericW CharUpperW LoadImageW RegisterDeviceNotificationW UnregisterDeviceNotification SendMessageTimeoutW FindWindowExW CloseClipboard SendMessageW EnumWindows SetForegroundWindow GetWindowThreadProcessId GetShellWindow FindWindowW ShowWindow IsWindow SetClipboardData wsprintfW GetClientRect GetSystemMetrics PostMessageW GetMessageW OpenClipboard RegisterWindowMessageW GetUserObjectInformationW GetThreadDesktop DispatchMessageW TranslateMessage UnregisterClassW

advapi32

ClearEventLogW CryptHashData CryptDestroyHash CryptDeriveKey CryptDestroyKey CryptEncrypt CryptDecrypt ChangeServiceConfig2W ControlService CreateServiceW EnumServicesStatusExW QueryServiceConfig2W QueryServiceStatus QueryServiceStatusEx StartServiceW BackupEventLogW CloseEventLog DeregisterEventSource OpenEventLogW RegisterEventSourceW ReportEventW RegRestoreKeyW SetEntriesInAclW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid ImpersonateLoggedOnUser RevertToSelf AddAccessAllowedAceEx AddAce AllocateAndInitializeSid FreeSid InitializeAcl GetUserNameW SetNamedSecurityInfoW EqualSid GetAce GetAclInformation RegDeleteKeyW RegFlushKey GetNamedSecurityInfoW CreateProcessAsUserW OpenThreadToken AccessCheck AddAccessAllowedAce AdjustTokenPrivileges DuplicateTokenEx GetSidSubAuthorityCount IsValidSecurityDescriptor LookupAccountNameW LookupPrivilegeValueW CreateProcessWithTokenW LogonUserW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW DeleteService GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorLength GetSecurityDescriptorOwner GetSecurityDescriptorSacl MakeAbsoluteSD MakeSelfRelativeSD CryptAcquireContextW CryptReleaseContext CryptGetHashParam ConvertStringSecurityDescriptorToSecurityDescriptorW DestroyPrivateObjectSecurity RegOpenCurrentUser RegConnectRegistryW RegOpenKeyW ImpersonateSelf RegNotifyChangeKeyValue ConvertStringSidToSidW SetThreadToken RegUnLoadKeyW RegLoadKeyW RegSaveKeyExW OpenProcessToken CheckTokenMembership CopySid DuplicateToken GetLengthSid GetSidLengthRequired GetSidSubAuthority GetTokenInformation InitializeSid IsValidSid LookupAccountSidW ConvertSidToStringSidW RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteValueW RegSetValueExW RegDeleteTreeW ChangeServiceConfigW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW RegCreateKeyExW RegCopyTreeW CryptCreateHash

shell32

SHGetPropertyStoreForWindow ord155 ord190 SHOpenFolderAndSelectItems SHGetPathFromIDListW SHBrowseForFolderW ord680 SHBindToParent SHFileOperationW SHGetFolderPathW SHChangeNotify ord165 SHGetMalloc SHCreateDirectoryExW ShellExecuteExW CommandLineToArgvW ShellExecuteW

ole32

CoGetClassObject CoInitializeSecurity CoInitialize CoUninitialize CoCreateGuid CoSetProxyBlanket CoCreateInstance CoInitializeEx OleInitialize CoTaskMemFree CLSIDFromString CreateStreamOnHGlobal PropVariantClear CoRevertToSelf CoImpersonateClient StringFromCLSID StringFromGUID2 CoTaskMemAlloc

oleaut32

VariantChangeType VariantCopy SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetDim SafeArrayRedim GetErrorInfo SafeArrayCreate VarUdateFromDate VarBstrCmp SysStringLen SysAllocStringByteLen SysStringByteLen VarDateFromStr VariantClear SysAllocStringLen SysAllocString VariantInit SetErrorInfo VariantTimeToSystemTime SystemTimeToVariantTime CreateErrorInfo SafeArrayDestroy SysFreeString

ntdll

RtlIpv4StringToAddressW RtlVirtualUnwind RtlIpv6StringToAddressW

iphlpapi

SendARP GetAdaptersAddresses GetAdaptersInfo GetAdapterIndex GetIfEntry GetIpNetEntry2

shlwapi

PathIsRelativeW PathRemoveFileSpecW PathFileExistsA AssocQueryStringW SHCopyKeyW PathIsNetworkPathW PathFindExtensionW SHDeleteEmptyKeyW UrlCanonicalizeW PathRemoveExtensionW PathFileExistsW PathAppendW PathQuoteSpacesW StrRetToBufW PathAddBackslashW PathFindFileNameW SHDeleteKeyW PathStripPathW PathRemoveBackslashW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock ExpandEnvironmentStringsForUserW UnloadUserProfile

ws2_32

WSACleanup WSAStartup WSAAddressToStringW htons getsockname listen recv recvfrom select send sendto accept gethostbyaddr WSAGetLastError WSAEnumNetworkEvents WSAEventSelect WSARecvFrom WSASendTo WSASocketW ntohs gethostbyname inet_ntoa ioctlsocket inet_addr bind closesocket socket connect htonl getpeername ntohl

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetGetUniversalNameW

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

crypt32

CryptUnprotectData CertOpenStore CertCloseStore CertAddEncodedCertificateToStore CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam CertOpenSystemStoreW CryptProtectData CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertCompareIntegerBlob CertCompareCertificateName CryptQueryObject CertGetCertificateChain CertFreeCertificateChain CryptVerifyDetachedMessageSignature CertGetCertificateContextProperty CertGetNameStringW CryptBinaryToStringW CertEnumCertificatesInStore

msi

ord173 ord224

wininet

InternetQueryOptionW InternetSetOptionW

rasapi32

RasSetEntryPropertiesW RasGetEntryPropertiesW

setupapi

SetupGetInfFileListW SetupUninstallOEMInfW SetupCopyOEMInfW SetupOpenInfFileW InstallHinfSectionW SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

winhttp

WinHttpReadData WinHttpSetCredentials WinHttpGetIEProxyConfigForCurrentUser WinHttpTimeToSystemTime WinHttpQueryAuthSchemes WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSendRequest WinHttpWriteData WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders

secur32

InitSecurityInterfaceW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

cmdres

CmdResClose CmdResInit CmdResLoadStringByDigitalId CmdResLoadStringByStrId CmdResGetLangInfo

Name

.textbss

Size

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

19.2MB

Virtual Size

19.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.4MB

Virtual Size

13.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

362KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

804B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

436KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=223, id=261, version=33145,

count=14, id=259, version=33145,

count=1, productName=Unmarked objects (old),

count=1, id=263, version=33145,

count=20, id=260, version=30034,

count=10, id=259, version=30034,

count=7, id=253, version=28518,

count=178, id=261, version=30034,

count=2, id=257, version=30159,

count=4, id=259, version=30159,

count=45, id=260, version=33145,

count=2, id=262, version=33145,

count=2, id=260, version=30153,

count=41, id=261, version=30153,

count=49, id=257, version=33145,

count=655, id=1, productName=Unmarked objects,

count=4, id=260, version=30159,

count=322, id=261, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,