2026-08-22_9b4f4b68648b0a052f23509c48da72a1_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_9b4f4b68648b0a052f23509c48da72a1_glassworm_icedid_njrat
Size 14.6MB
Sample260823-epgecssepc
SHA256 58ff829ddfdf5bb0971c5db92a43448eeff01e6dcee80d1eb808b69367cef0e4
MD5 9b4f4b68648b0a052f23509c48da72a1
SHA1 79c8eedeae1b5681ebf9facb97a9b533d6dc4c70
SHA512 69b86ed483339fc87b51a448766a5be4298205a888f35f2c43794ccf5797099437d5afc5a626fd72e686ab02731e419739f3f4111571e546bcbbd13d7e5f23fe
SSDEEP 49152:vrysR0nf+SOIxzFcWccNPac6AOSngrlC1enrVlDndQZ2gp5P+PpE9xRrkhCbuXqU:DokMTh6AOSGuGcyOK+Z/
TLSH
T16BF6A846E77941C6D3BFC039AA53962AFCB23896C779D7CBC2414A0A1722BF49D39701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_9b4f4b68648b0a052f23509c48da72a1_glassworm_icedid_njrat

File Explorer

2026-08-22_9b4f4b68648b0a052f23509c48da72a1_glassworm_icedid_njrat

.exe 14.6MB

2026-08-22_9b4f4b68648b0a052f23509c48da72a1_glassworm_icedid_njrat

IMPHASH bc1490d1c6a60f4a400986b0d7e47c8e
SHA256 58ff829ddfdf5bb0971c5db92a43448eeff01e6dcee80d1eb808b69367cef0e4
MD5 9b4f4b68648b0a052f23509c48da72a1
SHA1 79c8eedeae1b5681ebf9facb97a9b533d6dc4c70
SHA512 69b86ed483339fc87b51a448766a5be4298205a888f35f2c43794ccf5797099437d5afc5a626fd72e686ab02731e419739f3f4111571e546bcbbd13d7e5f23fe
SSDEEP 49152:vrysR0nf+SOIxzFcWccNPac6AOSngrlC1enrVlDndQZ2gp5P+PpE9xRrkhCbuXqU:DokMTh6AOSGuGcyOK+Z/
TLSH
T16BF6A846E77941C6D3BFC039AA53962AFCB23896C779D7CBC2414A0A1722BF49D39701
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Demian\Projects\CIS\CIS_UM\_out\Debug\x64\Symbols\CavWp.pdb

ntdll

RtlIpv4StringToAddressW RtlIpv6StringToAddressW RtlCaptureStackBackTrace VerSetConditionMask RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlUnwind

kernel32

MapViewOfFileEx FreeResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetCurrentDirectoryW CreateDirectoryW GetFileType SetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime TzSpecificLocalTimeToSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetThreadLocale GetSystemTime OpenSemaphoreW CreateSemaphoreW CopyFileW MoveFileW MoveFileExW GetComputerNameExW FlushFileBuffers FormatMessageA LockFileEx CreateFileMappingA UnlockFile HeapCompact DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetFileSizeEx GetPrivateProfileStringW GetPrivateProfileSectionNamesW SetThreadLocale IsDebuggerPresent ExitProcess ExitThread WriteConsoleW GetStdHandle GetModuleHandleExW InitializeCriticalSectionAndSpinCount WaitForMultipleObjectsEx CreateTimerQueue SetProcessAffinityMask VirtualFree GetVersionExW UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree GetThreadPriority SetThreadPriority SignalObjectAndWait FreeLibraryAndExitThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort GetComputerNameW GetCompressedFileSizeW RemoveDirectoryW GetFileTime GetDiskFreeSpaceW FindNextFileW FindFirstFileW FindClose K32GetProcessImageFileNameW K32GetModuleFileNameExW QueryFullProcessImageNameW GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW SetFileAttributesW GetTempFileNameW GetLongPathNameW GetFileInformationByHandle GetFileAttributesW GetDriveTypeW SearchPathW ExpandEnvironmentStringsW VerifyVersionInfoW lstrcpyW FileTimeToDosDateTime GetSystemTimeAsFileTime DeviceIoControl SetUnhandledExceptionFilter FileTimeToLocalFileTime GetLocalTime CreateMutexW ReleaseMutex OutputDebugStringW GetFileSize CreateThread DecodePointer GetCommandLineW CreateEventW WaitForSingleObject ResetEvent SetEvent UnmapViewOfFile MapViewOfFile GetTickCount OpenProcess GetCurrentThreadId QueryPerformanceFrequency QueryPerformanceCounter DuplicateHandle SetInformationJobObject AssignProcessToJobObject CreateJobObjectW GetPriorityClass SetPriorityClass FormatMessageW DeleteProcThreadAttributeList LocalAlloc SetProcessWorkingSetSize GetCurrentProcess WriteFile Process32NextW ReadFile DeleteFileW CreateFileW lstrcmpiW LoadLibraryExW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx RaiseException LoadLibraryW FreeLibrary GetCurrentProcessId LeaveCriticalSection EnterCriticalSection SetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar OutputDebugStringA FindResourceW GetThreadTimes SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError Sleep TlsSetValue TlsGetValue TlsAlloc GetCurrentThread GetLastError CloseHandle RegisterWaitForSingleObject UnregisterWaitEx QueryDepthSList InterlockedFlushSList InitializeProcThreadAttributeList SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW IsThreadAFiber HeapQueryInformation SetConsoleCtrlHandler InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter GetModuleHandleA SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualQuery GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared GetNativeSystemInfo GetExitCodeThread SwitchToThread InitializeSRWLock CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CreateDirectoryExW SetFilePointerEx SetFileInformationByHandle GetFinalPathNameByHandleW GetDiskFreeSpaceExW FindFirstFileExW SetCurrentDirectoryW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW CreateFileMappingW Process32FirstW CreateToolhelp32Snapshot CreateProcessW ResumeThread GetExitCodeProcess TerminateProcess GetProcessTimes OpenEventW SystemTimeToFileTime FileTimeToSystemTime K32EnumProcessModules K32EnumProcesses ReadProcessMemory SetFilePointer SystemTimeToTzSpecificLocalTime ReleaseSemaphore QueryDosDeviceW GetUserGeoID UpdateProcThreadAttribute GetGeoInfoW GetSystemWindowsDirectoryW LocalFree GetSystemInfo

user32

SendMessageW IsCharAlphaNumericW EmptyClipboard GetClientRect FindWindowExW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW UnregisterClassW CharUpperW wsprintfW GetSystemMetrics IsWindow ShowWindow FindWindowW GetShellWindow GetWindowThreadProcessId OpenClipboard CloseClipboard SetClipboardData CharNextW

advapi32

GetSecurityDescriptorLength QueryServiceStatusEx QueryServiceConfig2W EnumServicesStatusExW DeleteService CreateServiceW ControlService ChangeServiceConfig2W RegConnectRegistryW RegUnLoadKeyW RegLoadKeyW StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegOpenCurrentUser RegSaveKeyExW RegRestoreKeyW MakeSelfRelativeSD MakeAbsoluteSD GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl RegNotifyChangeKeyValue CheckTokenMembership GetNamedSecurityInfoW GetAclInformation GetAce RegFlushKey RegEnumValueW SetThreadToken ConvertSidToStringSidW CreateProcessWithTokenW LookupAccountNameW LookupAccountSidW SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSecurityDescriptor DuplicateToken AddAccessAllowedAce AccessCheck CreateProcessAsUserW LogonUserW OpenThreadToken CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptDestroyKey CryptDeriveKey CryptReleaseContext CryptAcquireContextW SetNamedSecurityInfoW FreeSid AllocateAndInitializeSid AddAce ConvertStringSidToSidW GetUserNameW IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidLengthRequired EqualSid DuplicateTokenEx CopySid OpenProcessToken RegSetValueExA RegQueryValueExA RegQueryValueA RegQueryInfoKeyA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AdjustTokenPrivileges AddAccessAllowedAceEx RegSetValueExW RegCreateKeyExW ReportEventW RegisterEventSourceW OpenEventLogW DeregisterEventSource CloseEventLog BackupEventLogW ClearEventLogW RegQueryValueExW RegOpenKeyExW RegCloseKey RevertToSelf ImpersonateLoggedOnUser

ole32

CoInitializeSecurity CLSIDFromString CoCreateGuid CoInitialize StringFromGUID2 CoCreateInstance CoReleaseServerProcess PropVariantClear CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoAddRefServerProcess

shell32

SHGetPropertyStoreForWindow SHBindToParent SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHOpenFolderAndSelectItems ord190 ord155 ShellExecuteExW SHFileOperationW SHGetFolderPathW ShellExecuteW ord165 SHCreateDirectoryExW ord680

oleaut32

VarUdateFromDate VarDateFromStr VariantTimeToSystemTime VariantInit VariantClear SystemTimeToVariantTime SysAllocStringByteLen SysStringByteLen UnRegisterTypeLi RegisterTypeLi LoadTypeLi SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetDim SafeArrayDestroy SysAllocString SysStringLen SysAllocStringLen VarUI4FromStr SysFreeString

shlwapi

PathFileExistsA StrRetToBufW PathAddBackslashW SHCopyKeyW PathFileExistsW PathIsRelativeW PathIsNetworkPathW SHDeleteKeyW PathFindFileNameW PathRemoveBackslashW PathRemoveFileSpecW

userenv

CreateEnvironmentBlock ExpandEnvironmentStringsForUserW UnloadUserProfile DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

ws2_32

inet_ntoa ntohs htonl WSAAddressToStringW ntohl inet_addr htons gethostbyname

crypt32

CryptUnprotectData CryptProtectData CertDuplicateCertificateContext CryptBinaryToStringW CertGetNameStringW CertGetCertificateContextProperty CertFreeCertificateContext

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetGetUniversalNameW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

fltlib

FilterSendMessage FilterReplyMessage FilterConnectCommunicationPort FilterGetMessage

msi

ord224

comdlg32

CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW

iphlpapi

GetAdapterIndex GetAdaptersInfo GetAdaptersAddresses SendARP GetIpNetEntry2 GetIfEntry

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperGetProvCertFromChain

setupapi

InstallHinfSectionW SetupOpenInfFileW SetupCloseInfFile SetupUninstallOEMInfW SetupCopyOEMInfW SetupGetInfFileListW SetupGetStringFieldW SetupFindFirstLineW

cmdres

CmdResLoadStringByDigitalId CmdResLoadStringByStrId CmdResGetLangInfo CmdResClose CmdResInit

Name

.text

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

127KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

706KB

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

771B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=217, id=261, version=33145,

count=13, id=259, version=33145,

count=1, productName=Unmarked objects (old),

count=1, id=262, version=33145,

count=1, id=263, version=33145,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=3, id=110, productName=VS2005 build 50727, version=50727,

count=2, id=253, version=28518,

count=167, id=261, version=30034,

count=45, id=260, version=33145,

count=2, id=257, version=30159,

count=564, id=1, productName=Unmarked objects,

count=43, id=257, version=33145,

count=2, id=259, version=30159,

count=4, id=260, version=30159,

count=143, id=261, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,