2026-09-16_8b6631e5bd814778f9116e50471b7f44_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_8b6631e5bd814778f9116e50471b7f44_cobalt-strike_glassworm_icedid_njrat_vidar
Size 5.3MB
Sample260916-m2zepsam7x
SHA256 b4c747e96237eea3238644a9a0078cd69d08fb4ab7720d52bb1346e1e64d377b
MD5 8b6631e5bd814778f9116e50471b7f44
SHA1 1eefa698d821b3f9441c77e1f76a19a9d789276a
SHA512 6b78bd6e04e79ba5bf26f81aa6c2a4eed2d88147feac4fe554fe7bc845b95b20c540548f625741d45c72c7ee382b877f6d91bb566c2c31ff52f7f7115c5fd0b6
SSDEEP 49152:dpHkvlXgsRdXrVDgmCiImyQnjhhX00L3VH9r+E2WTAj1a0uOhUmwx22dyh2xHAP2:dOXX2Jr18OhCdRAPA+k
TLSH
T19546281633F81388E1F7967C9AB75616CA72BC198B21C7CF0160915E1E33AE58D79B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_8b6631e5bd814778f9116e50471b7f44_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-09-16_8b6631e5bd814778f9116e50471b7f44_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 5.3MB

2026-09-16_8b6631e5bd814778f9116e50471b7f44_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 74413da4444278d50e7231cb3aa8b2ae
SHA256 b4c747e96237eea3238644a9a0078cd69d08fb4ab7720d52bb1346e1e64d377b
MD5 8b6631e5bd814778f9116e50471b7f44
SHA1 1eefa698d821b3f9441c77e1f76a19a9d789276a
SHA512 6b78bd6e04e79ba5bf26f81aa6c2a4eed2d88147feac4fe554fe7bc845b95b20c540548f625741d45c72c7ee382b877f6d91bb566c2c31ff52f7f7115c5fd0b6
SSDEEP 49152:dpHkvlXgsRdXrVDgmCiImyQnjhhX00L3VH9r+E2WTAj1a0uOhUmwx22dyh2xHAP2:dOXX2Jr18OhCdRAPA+k
TLSH
T19546281633F81388E1F7967C9AB75616CA72BC198B21C7CF0160915E1E33AE58D79B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\76724\LVInstaller\VideofusionInstaller\src\FeedbackTool\x64\CC_RELEASE\FeedbackTool.pdb

dbghelp

SymCleanup SymFunctionTableAccess64 SymGetModuleBase64 SymGetLineFromAddr64 SymSetOptions SymGetSearchPathW SymSetSearchPathW SymFromAddr StackWalk64 SymInitialize

propsys

InitPropVariantFromCLSID

ws2_32

ioctlsocket

powrprof

PowerDeterminePlatformRoleEx

setupapi

SetupDiEnumDeviceInfo CM_Get_Device_IDW SetupDiGetClassDevsW

winmm

timeEndPeriod timeGetTime timeBeginPeriod

kernel32

OpenProcess GetWindowsDirectoryW FreeLibrary LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetCurrentThread GetCurrentDirectoryW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime DecodePointer InitializeCriticalSectionEx DeleteCriticalSection GetFileInformationByHandle GetLocalTime GetTickCount CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime ProcessIdToSessionId GetCommandLineW GetEnvironmentVariableW CreateFileA GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetTempPathW GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetVersion GetSystemDirectoryW LocalAlloc lstrcmpW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW CopyFileW MoveFileExW WTSGetActiveConsoleSessionId OutputDebugStringA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent CreateEventW CreateThread MoveFileW InitializeCriticalSectionAndSpinCount GetCurrentThreadId LoadLibraryExW lstrcmpiW K32EnumProcessModules SetCurrentDirectoryW GetFileAttributesExW GetFinalPathNameByHandleW GetLogicalDriveStringsW GetVolumePathNameW DuplicateHandle GetModuleHandleA ReplaceFileW CreateHardLinkW FindFirstFileExW GetProcessId FormatMessageA GetModuleHandleExW GetNativeSystemInfo GetProductInfo IsWow64Process ReleaseSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency Sleep SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime WaitForSingleObject SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FlushFileBuffers GetProcAddress LockFileEx SetEndOfFile SetFileInformationByHandle SetFilePointerEx UnlockFileEx UnregisterWaitEx RegisterWaitForSingleObject IsDebuggerPresent GetThreadId GetUserDefaultLangID AcquireSRWLockExclusive lstrcmpiA GlobalMemoryStatusEx WaitForMultipleObjects TlsGetValue VirtualAlloc VirtualFree FlushViewOfFile VirtualQuery GetProcessTimes SetPriorityClass GetPriorityClass HeapSetInformation GetSystemInfo GetProcessIoCounters K32GetPerformanceInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsSetValue TlsAlloc TlsFree RtlCaptureStackBackTrace SetUnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetInformationJobObject GetModuleHandleExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce RtlVirtualUnwind CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableCS FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer TryEnterCriticalSection InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx OutputDebugStringW LoadLibraryExA VirtualProtect QueryThreadCycleTime LocalFree GetStringTypeW CompareStringEx GetCPInfo RtlPcToFileHeader RtlUnwindEx GetModuleHandleW GetVersionExW RtlUnwind GetTimeFormatW DeviceIoControl SetFileAttributesW SetLastError GetLongPathNameW GetFullPathNameW ExpandEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar CloseHandle WriteFile ReadFile GetFileSize CreateFileW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetUserDefaultLCID EnumSystemLocalesW GetFileInformationByHandleEx CreateSymbolicLinkW ReadConsoleW GetDriveTypeW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx WriteConsoleW InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode ExitProcess GetDateFormatW GetStdHandle GetLocaleInfoEx

user32

PeekMessageW DispatchMessageW TranslateMessage CharUpperW SetProcessDPIAware RemovePropW PostQuitMessage GetSystemMetrics GetUserObjectInformationW GetThreadDesktop CharNextW DestroyWindow DefWindowProcW GetWindowThreadProcessId GetClassNameW EnumWindows GetWindowLongW GetWindowTextLengthW GetWindowTextW PostMessageW ExitWindowsEx UnregisterClassW GetDesktopWindow GetDC GetQueueStatus SetTimer KillTimer RegisterClassExW CreateWindowExW GetWindowLongPtrW SetWindowLongPtrW MsgWaitForMultipleObjectsEx FindWindowExW SetPropW

gdi32

DeleteObject GetDeviceCaps

advapi32

GetSidSubAuthorityCount SystemFunction036 RegNotifyChangeKeyValue RegEnumValueW ConvertSidToStringSidW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteKeyExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl MapGenericMask IsValidSecurityDescriptor InitializeSecurityDescriptor ImpersonateLoggedOnUser GetFileSecurityW FreeSid EqualSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck LookupPrivilegeValueW RevertToSelf ImpersonateSelf AdjustTokenPrivileges OpenThreadToken SetThreadToken ConvertStringSidToSidW LookupAccountSidW SetTokenInformation GetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW SetNamedSecurityInfoW GetNamedSecurityInfoW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce

shell32

SHGetFolderPathA ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW

ole32

CoCreateInstance CoRevokeInitializeSpy CoRegisterInitializeSpy PropVariantClear CoTaskMemFree CoTaskMemRealloc CoUninitialize CoInitializeEx CoInitialize CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString

shlwapi

StrToIntW ord437 PathMatchSpecW StrChrW StrCmpNW StrCmpNIW StrRChrW StrCmpIW StrCpyNW PathAppendW PathFileExistsW SHSetValueW SHGetValueW PathRemoveFileSpecW PathIsDirectoryW PathGetDriveNumberW PathFindExtensionW PathAddBackslashW ord176

comctl32

InitCommonControlsEx

userenv

CreateEnvironmentBlock UnloadUserProfile LoadUserProfileW DestroyEnvironmentBlock

mpr

WNetGetResourceInformationW

psapi

GetProcessImageFileNameW EnumProcesses GetModuleFileNameExW EnumProcessModules

iphlpapi

GetAdaptersAddresses

??0MemoryAllocatorDumpGuid@trace_event@base@@QEAA@_K@Z ??0ReadOnlySharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??0UnsafeSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@XZ ??0WritableSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0WritableSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0WritableSharedMemoryRegion@base@@QEAA@XZ ??1ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??1UnsafeSharedMemoryRegion@base@@QEAA@XZ ??1WritableSharedMemoryRegion@base@@QEAA@XZ ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@$$QEAV012@@Z ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@AEBV012@@Z ??4ReadOnlySharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4UnsafeSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4WritableSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??8MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??9MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??MMemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ?ConvertToReadOnly@WritableSharedMemoryRegion@base@@SA?AVReadOnlySharedMemoryRegion@2@V12@@Z ?ConvertToUnsafe@WritableSharedMemoryRegion@base@@SA?AVUnsafeSharedMemoryRegion@2@V12@@Z ?Create@ReadOnlySharedMemoryRegion@base@@SA?AUMappedReadOnlyRegion@2@_K@Z ?Create@UnsafeSharedMemoryRegion@base@@SA?AV12@_K@Z ?Create@WritableSharedMemoryRegion@base@@SA?AV12@_K@Z ?Deserialize@ReadOnlySharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@UnsafeSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@WritableSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Duplicate@ReadOnlySharedMemoryRegion@base@@QEBA?AV12@XZ ?Duplicate@UnsafeSharedMemoryRegion@base@@QEBA?AV12@XZ ?GetGUID@ReadOnlySharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@UnsafeSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@WritableSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetPlatformHandle@ReadOnlySharedMemoryRegion@base@@QEBAPEAXXZ ?GetPlatformHandle@UnsafeSharedMemoryRegion@base@@QEBAPEAXXZ ?GetSize@ReadOnlySharedMemoryRegion@base@@QEBA_KXZ ?GetSize@UnsafeSharedMemoryRegion@base@@QEBA_KXZ ?GetSize@WritableSharedMemoryRegion@base@@QEBA_KXZ ?IsValid@ReadOnlySharedMemoryRegion@base@@QEBA_NXZ ?IsValid@UnsafeSharedMemoryRegion@base@@QEBA_NXZ ?IsValid@WritableSharedMemoryRegion@base@@QEBA_NXZ ?Map@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@XZ ?Map@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?Map@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?MapAt@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@J_K@Z ?MapAt@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?MapAt@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?TakeHandleForSerialization@ReadOnlySharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@UnsafeSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@WritableSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?ThrowBadVariantAccess@variant_internal@absl@@YAXXZ ?ToUint64@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_KXZ ?UnsafeGetPlatformHandle@WritableSharedMemoryRegion@base@@QEBAPEAXXZ ?create_hook_@ReadOnlySharedMemoryRegion@base@@0P6A?AUMappedReadOnlyRegion@2@_K@ZEA ?create_hook_@UnsafeSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?create_hook_@WritableSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?empty@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NXZ ?g_swallow_stream@logging@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@EA ?kDisableBestEffortTasks@switches@@3QBDB ?kDisableBreakpad@switches@@3QBDB ?kDisableFeatures@switches@@3QBDB ?kDisableHighResTimer@switches@@3QBDB ?kDisableLowEndDeviceMode@switches@@3QBDB ?kDisableUsbKeyboardDetect@switches@@3QBDB ?kEnableBackgroundThreadPool@switches@@3QBDB ?kEnableCrashReporter@switches@@3QBDB ?kEnableFeatures@switches@@3QBDB ?kEnableLowEndDeviceMode@switches@@3QBDB ?kForceFieldTrials@switches@@3QBDB ?kFullMemoryCrashReport@switches@@3QBDB ?kLogBestEffortTasks@switches@@3QBDB ?kNoErrorDialogs@switches@@3QBDB ?kProfilingAtStart@switches@@3QBDB ?kProfilingFile@switches@@3QBDB ?kProfilingFlush@switches@@3QBDB ?kTestChildProcess@switches@@3QBDB ?kTestDoNotInitializeIcu@switches@@3QBDB ?kTraceToFile@switches@@3QBDB ?kTraceToFileName@switches@@3QBDB ?kV@switches@@3QBDB ?kVModule@switches@@3QBDB ?kWaitForDebugger@switches@@3QBDB ?set_create_hook@ReadOnlySharedMemoryRegion@base@@CAXP6A?AUMappedReadOnlyRegion@2@_K@Z@Z ?set_create_hook@UnsafeSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?set_create_hook@WritableSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?throw_bad_optional_access@optional_internal@absl@@YAXXZ GetHandleVerifier

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

minATL

Size

1024B

Virtual Size

809B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_8b6631e5bd814778f9116e50471b7f44_cobalt-strike_glassworm_icedid_njrat_vidar

dbghelp

propsys

ws2_32

powrprof

setupapi

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

userenv

mpr

psapi

iphlpapi

generic