2026-09-19_a3edb56d922a560a92c025de47bba2fc_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_a3edb56d922a560a92c025de47bba2fc_glassworm_icedid_njrat
Size 3.0MB
Sample260919-2aadtsty6r
SHA256 d8a67a5f0402f8b6db17f5a184e53b6f716fe43be656c7240dfc603a6dc2234b
MD5 a3edb56d922a560a92c025de47bba2fc
SHA1 c3729d460a0c1c985c6b30e4dab64ca97e689a64
SHA512 99eb05ddfaea400838016607f6402c7bf0c560b32506a16cb0ee00b83ca37f5145159e661b99bd6d24501df05789902e0db90ae32e13c4f987fb6cf7197e359e
SSDEEP 24576:LQ7COhpkjFvhSCuKV1t5A3MVvOUBlpOSYTLFV:c79hpkjf95ASGUhYT
TLSH
T1D1E5D81BF7B650D5E1BAC038D553622AFC7134A6833C97EB92818E455B60BE8EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_a3edb56d922a560a92c025de47bba2fc_glassworm_icedid_njrat

File Explorer

2026-09-19_a3edb56d922a560a92c025de47bba2fc_glassworm_icedid_njrat

.exe 3.0MB

2026-09-19_a3edb56d922a560a92c025de47bba2fc_glassworm_icedid_njrat

IMPHASH 06bf125ebfc752c0ece83d25e67b0db7
SHA256 d8a67a5f0402f8b6db17f5a184e53b6f716fe43be656c7240dfc603a6dc2234b
MD5 a3edb56d922a560a92c025de47bba2fc
SHA1 c3729d460a0c1c985c6b30e4dab64ca97e689a64
SHA512 99eb05ddfaea400838016607f6402c7bf0c560b32506a16cb0ee00b83ca37f5145159e661b99bd6d24501df05789902e0db90ae32e13c4f987fb6cf7197e359e
SSDEEP 24576:LQ7COhpkjFvhSCuKV1t5A3MVvOUBlpOSYTLFV:c79hpkjf95ASGUhYT
TLSH
T1D1E5D81BF7B650D5E1BAC038D553622AFC7134A6833C97EB92818E455B60BE8EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1182384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\r4t\build\r4t.pdb

shell32

SHGetFolderPathA

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

winmm

mciSendStringA

kernel32

GetTickCount GetSystemFirmwareTable GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryFullProcessImageNameA GetComputerNameA GetFileAttributesA TerminateProcess CreateProcessA GetModuleFileNameA CopyFileA GetConsoleWindow GetSystemInfo Process32FirstW Process32NextW GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW ReadFile FlushFileBuffers GetTimeZoneInformation GetFileAttributesExW CreateProcessW GetExitCodeProcess GlobalMemoryStatusEx OpenProcess GetCurrentProcess Sleep DeviceIoControl CloseHandle GetVolumeInformationA GetTempPathA GetLogicalDrives GetDriveTypeA GetDiskFreeSpaceExA DeleteFileA CreateFileA GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile CreateToolhelp32Snapshot GetSystemTimeAsFileTime WaitForSingleObject SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapQueryInformation HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber RtlUnwind FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RaiseException GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread HeapSize HeapValidate ExitProcess SetConsoleCtrlHandler GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale

user32

CreateWindowExA DestroyWindow IsWindowVisible GetSystemMetrics GetDC ShowWindow GetWindow GetWindowThreadProcessId EnumWindows ReleaseDC

gdi32

BitBlt CreateCompatibleBitmap SetBrushOrgEx SetStretchBltMode SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC

advapi32

OpenProcessToken GetUserNameA RegSetValueExA RegDeleteValueA RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey GetTokenInformation

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpQueryInfoA HttpOpenRequestA HttpSendRequestA

Name

.textbss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

536KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_a3edb56d922a560a92c025de47bba2fc_glassworm_icedid_njrat

shell32

ole32

oleaut32

winmm

kernel32

user32

gdi32

advapi32

iphlpapi

wininet

generic