2026-09-16_9926099b9f02577d234d898034583c52_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_9926099b9f02577d234d898034583c52_glassworm_icedid_njrat_vidar
Size 6.8MB
Sample260916-mj478sae69
SHA256 5e0583acaf8f715c153137c650d36fe239d0d8f7cd0784d31d6ffc35a167840f
MD5 9926099b9f02577d234d898034583c52
SHA1 693fbf4ad8896a87c68f3174dce070c4d6d71bb6
SHA512 fbd2fa2d074dabf11171edd7f272a73856c999e75d2a015fcdf98b9f56c36188ddf0a972db9cfa11d898e2d390bc019d95c1889dde253f04e451e1e803b1e6d5
SSDEEP 49152:fEXL9iol2DYzZ2Qc9q8ei0oimC/FPI2DCrCBIMWCvWbD72Hv1wOhLnis2b+RtAsX:fKaDSwFME7D7Kjjq0usjmqMhHk
TLSH
T12A666C39ABB4C1E5F9ABD83CA9778671FAB279510833530B89E1C21E6F336524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_9926099b9f02577d234d898034583c52_glassworm_icedid_njrat_vidar

File Explorer

2026-09-16_9926099b9f02577d234d898034583c52_glassworm_icedid_njrat_vidar

.exe 6.8MB

2026-09-16_9926099b9f02577d234d898034583c52_glassworm_icedid_njrat_vidar

IMPHASH 91b6dee46d1e9cb862048488e244bc70
SHA256 5e0583acaf8f715c153137c650d36fe239d0d8f7cd0784d31d6ffc35a167840f
MD5 9926099b9f02577d234d898034583c52
SHA1 693fbf4ad8896a87c68f3174dce070c4d6d71bb6
SHA512 fbd2fa2d074dabf11171edd7f272a73856c999e75d2a015fcdf98b9f56c36188ddf0a972db9cfa11d898e2d390bc019d95c1889dde253f04e451e1e803b1e6d5
SSDEEP 49152:fEXL9iol2DYzZ2Qc9q8ei0oimC/FPI2DCrCBIMWCvWbD72Hv1wOhLnis2b+RtAsX:fKaDSwFME7D7Kjjq0usjmqMhHk
TLSH
T12A666C39ABB4C1E5F9ABD83CA9778671FAB279510833530B89E1C21E6F336524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3818544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\Integrator.pdb

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegSetValueExW RegQueryValueExW EventWriteTransfer EventRegister EventUnregister RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority AllocateAndInitializeSid FreeSid EqualSid OpenProcessToken CreateWellKnownSid RevertToSelf OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW ChangeServiceConfigW GetLengthSid CopySid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertSidToStringSidA CheckTokenMembership RegNotifyChangeKeyValue EventWrite RegGetValueA SetNamedSecurityInfoW GetSecurityDescriptorControl SetEntriesInAclW BuildTrusteeWithSidW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress GetModuleHandleExW K32GetProcessMemoryInfo GlobalMemoryStatusEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock GetCurrentProcessId FileTimeToSystemTime GetUserDefaultLocaleName IsValidCodePage SetLastError WideCharToMultiByte GetSystemTime SystemTimeToFileTime GetCPInfoExW CreateEventExW GetStringTypeW RaiseException LoadLibraryExW GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetVersionExW GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource OpenProcess GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW FormatMessageW FormatMessageA LocalFree GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW CreateActCtxW ActivateActCtx HeapFree OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc GetProcessHeap ReleaseMutex OpenMutexW WaitForSingleObjectEx lstrlenW GetPriorityClass GetExitCodeProcess ProcessIdToSessionId GetCurrentThread GetExitCodeThread WaitForMultipleObjects WaitForMultipleObjectsEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace MapViewOfFile ReadFile SetFilePointerEx GetFileSizeEx GetTempPathW GetTempFileNameW GetTickCount SetEvent CreateDirectoryW FindNextFileW FindFirstFileW lstrcmpW RemoveDirectoryW CopyFileW GetFileAttributesW CreateFileMappingW FlushViewOfFile GetFileType SetEndOfFile SetFilePointer GetOverlappedResult UnlockFile LockFile SetFileInformationByHandle GetFileInformationByHandleEx GetLongPathNameW GetFullPathNameW CreateMutexW ReleaseSemaphore OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA GlobalFree LocalAlloc DeleteFileA GetTempPathA GetCommandLineW SetEnvironmentVariableW GetTimeZoneInformation IsValidLocale CreateEventW WaitForSingleObject CreateThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo LockResource FlushFileBuffers CancelIoEx WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree VirtualAlloc LCMapStringEx LCIDToLocaleName LocaleNameToLCID GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread DecodePointer AreFileApisANSI HeapCreate GetDiskFreeSpaceW InitializeCriticalSection GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetDiskFreeSpaceA GetFileAttributesA HeapReAlloc HeapCompact HeapDestroy LockFileEx GetSystemDefaultLCID GetLocalTime LoadLibraryExA VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SetStdHandle EnumSystemLocalesW GetTimeFormatW GetDateFormatW GetCommandLineA ExitProcess GetStdHandle ExitThread GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer GetFileSize CreateFileMappingA CloseHandle CreateFileA UnmapViewOfFile CreateTimerQueueTimer GetUserGeoID FindFirstFileExW FindClose SetFileAttributesW DeleteFileW GetModuleFileNameW MultiByteToWideChar GetStringTypeExW GetFileAttributesExW ExpandEnvironmentStringsW IsWow64Process CompareStringEx GetLastError GlobalAlloc Sleep GetCurrentProcess WriteFile RtlUnwind

ole32

IIDFromString CoCreateInstance CoSetProxyBlanket CoTaskMemFree CLSIDFromString StringFromGUID2 CoCreateGuid CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemAlloc CreateStreamOnHGlobal CoRevokeInitializeSpy CoInitialize CoUninitialize CoRegisterInitializeSpy

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

wintrust

WintrustAddActionID WintrustRemoveActionID

iphlpapi

GetAdaptersInfo

gdi32

GetDeviceCaps

winspool.drv

AddPrinterW DeletePrinter XcvDataW OpenPrinterW DeletePrinterDriverExW ClosePrinter InstallPrinterDriverFromPackageW UploadPrinterDriverPackageW

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_9926099b9f02577d234d898034583c52_glassworm_icedid_njrat_vidar

advapi32

kernel32

ole32

oleaut32

wintrust

iphlpapi

gdi32

winspool.drv

generic