2026-09-16_3090be0c769e235787fd710919c5b320_glassworm_icedid_njrat_vidar

General

Target
2026-09-16_3090be0c769e235787fd710919c5b320_glassworm_icedid_njrat_vidar
Size 2.5MB
Sample260916-qrh7hsbr21
SHA256 c7688f39626cac18b9f1ad7995dcb1e2ecafb516380418cf1772a6ca999a6643
MD5 3090be0c769e235787fd710919c5b320
SHA1 4ed94ecdde3b5285357603068d698e06bf0b8cff
SHA512 943fe7f5d345015079c08c83df4058dc2a1454460dc437dc0cc685477634d1a8dcd6de78cadb8f5d9a77861fed4a880003d8e20d647e3243ddfef1aceb0c2834
SSDEEP 49152:AIAoeqatglr+Ez+Ez+EjIAoeqatglr+Ez+Ez+EjIAoeqatglsiw2s:AXaXaX9
TLSH
T1C2C56B46F69588F2D4674231889782B7DBB2B8121F22D78F6354832E6F337D0AE39751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_3090be0c769e235787fd710919c5b320_glassworm_icedid_njrat_vidar

File Explorer

2026-09-16_3090be0c769e235787fd710919c5b320_glassworm_icedid_njrat_vidar

.exe 2.5MB

2026-09-16_3090be0c769e235787fd710919c5b320_glassworm_icedid_njrat_vidar

IMPHASH 69c8890c645bc52baf5347009201dcb7
SHA256 c7688f39626cac18b9f1ad7995dcb1e2ecafb516380418cf1772a6ca999a6643
MD5 3090be0c769e235787fd710919c5b320
SHA1 4ed94ecdde3b5285357603068d698e06bf0b8cff
SHA512 943fe7f5d345015079c08c83df4058dc2a1454460dc437dc0cc685477634d1a8dcd6de78cadb8f5d9a77861fed4a880003d8e20d647e3243ddfef1aceb0c2834
SSDEEP 49152:AIAoeqatglr+Ez+Ez+EjIAoeqatglr+Ez+Ez+EjIAoeqatglsiw2s:AXaXaX9
TLSH
T1C2C56B46F69588F2D4674231889782B7DBB2B8121F22D78F6354832E6F337D0AE39751
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

42:74:2b:7b:3d:59:a1:65:d9:21:07:24:29:70:d5:b3:25:b9:be:52

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 31, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Minor OS version

1

Major OS version

6

Entry point

83976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

CloseHandle GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent ReleaseMutex WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer RaiseException FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleW LoadLibraryExA VirtualQuery VirtualProtect

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIfEx RpcServerUnregisterIf NdrServerCall2 RpcImpersonateClient RpcRevertToSelf

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_3090be0c769e235787fd710919c5b320_glassworm_icedid_njrat_vidar

PE Signature issue

advapi32

kernel32

rpcrt4

wintrust

generic