2026-09-16_83837070dbcf879882f08109e3499afd_amadey_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_83837070dbcf879882f08109e3499afd_amadey_glassworm_icedid_njrat_vidar
Size 1.6MB
Sample260916-yllz8add84
SHA256 0f9ccbd7d96a39767db83fe74c90d38637502eef422abbd23030eb0fb2512483
MD5 83837070dbcf879882f08109e3499afd
SHA1 cb5d2d9e3587a3e1f274142c73ee17902c5a3af5
SHA512 24e6df79576ab0d51e0f67523c6ce3f50fe8ba5c4b5d99ff3b327f1a9ccc70b831b9d466a7510c94c28f51fe514a614c97976f59e1df6d470650764d54b90b1c
SSDEEP 49152:bB+ES+E9oqat7+E9B+EJe+ES+E9oqatgl8cK:vOOK
TLSH
T192755B45FAC944A1E47702704CABC2BA9A31BD254F12DAEFF244935E6E33BD09E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_83837070dbcf879882f08109e3499afd_amadey_glassworm_icedid_njrat_vidar

File Explorer

2026-09-16_83837070dbcf879882f08109e3499afd_amadey_glassworm_icedid_njrat_vidar

.exe 1.6MB

2026-09-16_83837070dbcf879882f08109e3499afd_amadey_glassworm_icedid_njrat_vidar

IMPHASH a220beeafc75603adf8a3e0eebda23d9
SHA256 0f9ccbd7d96a39767db83fe74c90d38637502eef422abbd23030eb0fb2512483
MD5 83837070dbcf879882f08109e3499afd
SHA1 cb5d2d9e3587a3e1f274142c73ee17902c5a3af5
SHA512 24e6df79576ab0d51e0f67523c6ce3f50fe8ba5c4b5d99ff3b327f1a9ccc70b831b9d466a7510c94c28f51fe514a614c97976f59e1df6d470650764d54b90b1c
SSDEEP 49152:bB+ES+E9oqat7+E9B+EJe+ES+E9oqatgl8cK:vOOK
TLSH
T192755B45FAC944A1E47702704CABC2BA9A31BD254F12DAEFF244935E6E33BD09E35721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b0:92:72:cf:91:22:09:3a:f3:d6:a6:ab:31:5d:84:ca:96:cb:5a:c4:84:12:26:20:71:58:c5:ed:a4:af:d2:b0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

cd:70:45:c9:54:a9:8f:39:75:f2:d7:98:33:5c:e6:57:49:4d:d0:be

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:89:62:0d:9e:95:d3:61:6b:a8:00:00:00:00:00:89

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:c6:fe:ea:06:36:34:01:16:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Minor OS version

Major OS version

Entry point

19328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

diagtrackrunner.pdb

advapi32

EventWriteTransfer RegCreateKeyExW RegDeleteValueW RegGetValueW RegCloseKey OpenThreadToken

kernel32

LoadLibraryExW SetEnvironmentVariableW GetModuleHandleExW OutputDebugStringW GetModuleHandleW GetCurrentThread FormatMessageW RaiseException GetLastError SetLastError GetProcAddress GetModuleFileNameA GetCurrentThreadId CloseHandle ExpandEnvironmentStringsW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount TerminateProcess

msvcrt

_CxxThrowException ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ _callnewh _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode _commode ?terminate@@YAXXZ _lock _unlock __dllonexit _onexit ??1type_info@@UEAA@XZ _purecall _vsnwprintf malloc memcpy _initterm __CxxFrameHandler3 free memmove _wcsicmp ??3@YAXPEAX@Z ??0exception@@QEAA@AEBQEBDH@Z memset

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

userenv

ExpandEnvironmentStringsForUserW

diagtrack

RunDll32Main

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_83837070dbcf879882f08109e3499afd_amadey_glassworm_icedid_njrat_vidar

PE Signature issue

PE Signature issue

advapi32

kernel32

msvcrt

ntdll

userenv

diagtrack

generic