2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar

General

Target
2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar
Size 1.3MB
Sample260926-s2wayaxtd1
SHA256 9c83820291c35f6ebf4ca0a6d32afeff9b426e121a26e6a6dc5c1d54c0f828ae
MD5 bf793575f6564a55641fa9258268a241
SHA1 eb5c9d461e4364b3956fc3b70247413ad64c9e1a
SHA512 a81c1077c29d67b8154b1bcba0df218617ed33a5c7911d55eca49da30633dae174cf84ff137241316950336fe710d2dfffbb615e1342bcb9082611d7a8ff37e2
SSDEEP 24576:4uzu3yio0rzZK9bbyxknw4FYnshx8OfVe247:4uzuCijr8b+x4x8EVep
TLSH
T15155D117E6D401F4D06AC139CB22A122FEB5F8850A74B69F13B4472A3F77A645F2EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar

File Explorer

2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar

.exe 1.3MB

2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar

IMPHASH d7f0239cbcc8cc29e355d05504648d8a
SHA256 9c83820291c35f6ebf4ca0a6d32afeff9b426e121a26e6a6dc5c1d54c0f828ae
MD5 bf793575f6564a55641fa9258268a241
SHA1 eb5c9d461e4364b3956fc3b70247413ad64c9e1a
SHA512 a81c1077c29d67b8154b1bcba0df218617ed33a5c7911d55eca49da30633dae174cf84ff137241316950336fe710d2dfffbb615e1342bcb9082611d7a8ff37e2
SSDEEP 24576:4uzu3yio0rzZK9bbyxknw4FYnshx8OfVe247:4uzuCijr8b+x4x8EVep
TLSH
T15155D117E6D401F4D06AC139CB22A122FEB5F8850A74B69F13B4472A3F77A645F2EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

359464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyA RegOpenKeyA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

user32

FindWindowA GetCapture GetClipboardOwner GetCursorPos GetForegroundWindow GetQueueStatus SendMessageA

kernel32

CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateProcessW CreateThread DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileSize GetFileTime GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalMemoryStatus HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFileTimeToFileTime LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

514KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar

advapi32

user32

kernel32

generic