2026-09-16_89eb470197913f599ae4814f7ba33a8c_glassworm_icedid_njrat_vidar

General

Target
2026-09-16_89eb470197913f599ae4814f7ba33a8c_glassworm_icedid_njrat_vidar
Size 2.6MB
Sample260916-m4llmaam71
SHA256 58293e8fdb3fbba0cee351aae8e65a39b84b3002d6960ce561cbc3ed04960b6e
MD5 89eb470197913f599ae4814f7ba33a8c
SHA1 6a87915001732bc3e7610c0ae789af6286b2a9fa
SHA512 fa5a6479854c1044c913eba056d5815410bb494de5c11012325fd3e870fd76b9dac6feb5e902ca2af907389ac50d69894f32eebcac107994b28c3543619e330b
SSDEEP 49152:4SqatglU+E2V+E2/+EYn+E2/+E8+ES+E++E2E+ES+E++E2/+E8+ES+E2SqatglTG:vuyJ
TLSH
T1BAC55C06F58650F1E477117049ABD2BB8A71FD214B218EEFE688832E5E33BD0AD35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_89eb470197913f599ae4814f7ba33a8c_glassworm_icedid_njrat_vidar

File Explorer

2026-09-16_89eb470197913f599ae4814f7ba33a8c_glassworm_icedid_njrat_vidar

.exe 2.6MB

2026-09-16_89eb470197913f599ae4814f7ba33a8c_glassworm_icedid_njrat_vidar

IMPHASH a26cb263b9dc97b5627f1e68caac6231
SHA256 58293e8fdb3fbba0cee351aae8e65a39b84b3002d6960ce561cbc3ed04960b6e
MD5 89eb470197913f599ae4814f7ba33a8c
SHA1 6a87915001732bc3e7610c0ae789af6286b2a9fa
SHA512 fa5a6479854c1044c913eba056d5815410bb494de5c11012325fd3e870fd76b9dac6feb5e902ca2af907389ac50d69894f32eebcac107994b28c3543619e330b
SSDEEP 49152:4SqatglU+E2V+E2/+EYn+E2/+E8+ES+E++E2E+ES+E++E2/+E8+ES+E2SqatglTG:vuyJ
TLSH
T1BAC55C06F58650F1E477117049ABD2BB8A71FD214B218EEFE688832E5E33BD0AD35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6c:a6:4a:51:9a:30:a3:97:2c:a4:ed:d0:81:ab:0a:09:c8:ba:6b:2e:ce:9f:f9:a8:7e:2c:fb:b6:2d:61:b7:9e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 7, 2019

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

10

Entry point

32016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bootsect.pdb

advapi32

EventUnregister EventRegister EventWriteTransfer RegOpenKeyExW RegCloseKey RegQueryValueExW

kernel32

GetModuleHandleExW SetFilePointer GetLastError GetProcAddress FreeLibrary GetConsoleOutputCP GetStdHandle GetModuleFileNameW LocalAlloc GetConsoleMode FormatMessageW QueryDosDeviceW LocalFree WideCharToMultiByte GetFileType TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter Sleep ReadFile WriteFile WriteConsoleW SetLastError GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW CreateFileW GetVersionExW SearchPathW UnmapViewOfFile CloseHandle FindResourceExW LoadResource CreateFileMappingW MapViewOfFile LoadLibraryExW

msvcrt

_snwscanf_s bsearch wcsncmp wcsstr wcsnlen memcpy ?terminate@@YAXXZ _fmode __C_specific_handler _initterm memset __setusermatherr _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter iswxdigit _vsnwprintf _wcsnicmp _stricmp swprintf_s isalpha wcscpy_s _wcsicmp _wcslwr _commode

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry NtWaitForSingleObject RtlFreeHeap NtQueryDirectoryObject NtCreateEvent NtOpenDirectoryObject NtDeviceIoControlFile NtQuerySymbolicLinkObject RtlAllocateHeap NtOpenSymbolicLinkObject NtResetEvent NtOpenFile NtQueryVolumeInformationFile RtlNtStatusToDosError NtFsControlFile NtClose RtlInitUnicodeString NtQuerySystemInformation RtlCaptureContext NtQueryValueKey NtQueryBootEntryOrder NtQueryBootOptions NtTranslateFilePath NtEnumerateBootEntries NtAdjustPrivilegesToken NtOpenProcessTokenEx NtSetInformationThread NtOpenThreadTokenEx RtlImpersonateSelf NtOpenKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_89eb470197913f599ae4814f7ba33a8c_glassworm_icedid_njrat_vidar

PE Signature issue

advapi32

kernel32

msvcrt

ntdll

generic