2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar
Size 2.4MB
Sample260910-s7xe7atzby
SHA256 bfe566e999fe40fd42a6a5e8577c76e05931e52304504aaf15411535806bea5c
MD5 6aef6190c26a1a3dba61479e3d129222
SHA1 ce462ef3337583f716dd3b9bf174801930804dfd
SHA512 316fdcbccf82fe388b17dbd9d999aaa5537cbbc261fc2287eac3f3fa2d6fe9ee4ce132dd28634044b43e2f065cece14c151add226af2e385dc32c7704db9047e
SSDEEP 49152:TZ/1OLUjPHM4TUtLFFuBjyMC5MSyCTrAGLVufq81ID:TKkeHoO9
TLSH
T181B5BE1F2A9702B8D2B6993AC653590ED321BDF103D2998F116DF39B1F33B825EE5214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar

File Explorer

2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar

.exe 2.4MB

2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar

IMPHASH b3db0ff3c9a173f95dc82029e08492e6
SHA256 bfe566e999fe40fd42a6a5e8577c76e05931e52304504aaf15411535806bea5c
MD5 6aef6190c26a1a3dba61479e3d129222
SHA1 ce462ef3337583f716dd3b9bf174801930804dfd
SHA512 316fdcbccf82fe388b17dbd9d999aaa5537cbbc261fc2287eac3f3fa2d6fe9ee4ce132dd28634044b43e2f065cece14c151add226af2e385dc32c7704db9047e
SSDEEP 49152:TZ/1OLUjPHM4TUtLFFuBjyMC5MSyCTrAGLVufq81ID:TKkeHoO9
TLSH
T181B5BE1F2A9702B8D2B6993AC653590ED321BDF103D2998F116DF39B1F33B825EE5214
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

17:b0:40:3f:c3:59:ff:12:74:49:2b:06:75:aa:1a:c3:d7:f9:2b:13

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Hangzhou Infogo Tech Co.\, Ltd.,O=Hangzhou Infogo Tech Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Chains

Sep 10, 2026

CN=Hangzhou Infogo Tech Co.\, Ltd.,O=Hangzhou Infogo Tech Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Minor OS version

Major OS version

Entry point

260272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Git\napengine\artifacts\UnityCrashHandler\release_win64\UnityCrashHandler64.pdb

user32

CreateIconFromResourceEx SetWindowPos GetWindowLongA InflateRect AdjustWindowRect SendMessageW DialogBoxParamA LookupIconIdFromDirectoryEx SetWindowTextW OffsetRect EndDialog GetDlgItem SendDlgItemMessageA UnionRect LoadImageA GetIconInfo SetForegroundWindow

kernel32

InterlockedPopEntrySList VirtualProtect GetVersionExW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SignalObjectAndWait CreateTimerQueue WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetEndOfFile GetFileSizeEx GetFileAttributesExW HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue CloseHandle RaiseException GetCurrentThread OpenThread GetThreadTimes GetModuleHandleA GetProcAddress EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection WaitForSingleObjectEx SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority GetThreadPriority RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind VerSetConditionMask FreeLibrary GetModuleFileNameA GetModuleHandleW LoadLibraryA MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableA GetCurrentDirectoryA GetCurrentDirectoryW GetFileAttributesA OutputDebugStringA GetLastError SetLastError WaitForSingleObject CreateEventW GetCurrentProcess QueryDepthSList SuspendThread ResumeThread GetThreadContext ReadProcessMemory LocalFree FormatMessageW VerifyVersionInfoW CreateToolhelp32Snapshot Thread32First Thread32Next LoadLibraryW SetEvent WaitForMultipleObjectsEx Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId GetThreadId OpenProcess GetStdHandle SetCurrentDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileSize ReadFile GetTempPathW GetSystemTime GetSystemTimeAsFileTime CopyFileExW AllocConsole SetErrorMode GetCommandLineW FindClose FindFirstFileW FindNextFileW FlushFileBuffers WriteFile InitializeCriticalSection CreateEventA TerminateThread GetExitCodeThread LoadLibraryExW LockResource SizeofResource EnumResourceNamesA FindResourceA IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency ReleaseSemaphore TlsAlloc TlsFree VirtualAlloc VirtualFree FlsGetValue FlsAlloc HeapFree HeapAlloc FreeLibraryAndExitThread GetModuleFileNameW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP SetConsoleCtrlHandler GetFileType UnregisterWaitEx SetStdHandle GetModuleHandleExW ExitProcess InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetLocaleInfoW GetCurrentProcessId LoadResource LCMapStringW CompareStringW GetTickCount TlsSetValue TlsGetValue DecodePointer EncodePointer GetCPInfo DuplicateHandle ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetStringTypeW

dbghelp

SymRegisterFunctionEntryCallback64 SymLoadModuleEx

shell32

CommandLineToArgvW SHCreateDirectoryExW

ole32

CoCreateGuid CoTaskMemFree CoInitializeEx

advapi32

GetUserNameA

wininet

HttpSendRequestA HttpQueryInfoA HttpOpenRequestA InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

gdi32

GetObjectA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

547KB

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar

PE Signature issue

user32

kernel32

dbghelp

shell32

ole32

advapi32

wininet

gdi32

version

generic