2026-09-30_abd2363ea53e2f8c857b9686b50c3f22_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

Reason

scan timeout

General

Target
2026-09-30_abd2363ea53e2f8c857b9686b50c3f22_glassworm_icedid_njrat_vidar
Size 50.1MB
Sample261001-j4pfqsec63
SHA256 cdd973b2e44dcd02b054c1235ef0a3cc865e4620dee03f50d71f41376dd51229
MD5 abd2363ea53e2f8c857b9686b50c3f22
SHA1 848947cb5a7ffa6ebb4bfe947f5f5ee94706ed50
SHA512 f2de22317c4eb897ccfcdfea28c8b5c4506673e6ba6c1828b7b114cdad36906d0b72633c40ea972d2acbdab53aad1c93082c78685e23da75599c4b16c3a5c764
SSDEEP 393216:6tdMdVsjTi8Zg17YbmvIzme0XhK2FQ8YYKXeWfINSW3biLa3L9NJ7W51AmOW1ZEM:TMAY2qYK0Nz3biGRN1+qbwewbkTi
TLSH
T1FFB76B4262A87CD1D036A630DBBB8FF1C769BC555228825F1090FA473D3A783792B7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_abd2363ea53e2f8c857b9686b50c3f22_glassworm_icedid_njrat_vidar

File Explorer

2026-09-30_abd2363ea53e2f8c857b9686b50c3f22_glassworm_icedid_njrat_vidar

.exe 50.1MB

2026-09-30_abd2363ea53e2f8c857b9686b50c3f22_glassworm_icedid_njrat_vidar

IMPHASH 77772a676050626c94eda477a6c312fe
SHA256 cdd973b2e44dcd02b054c1235ef0a3cc865e4620dee03f50d71f41376dd51229
MD5 abd2363ea53e2f8c857b9686b50c3f22
SHA1 848947cb5a7ffa6ebb4bfe947f5f5ee94706ed50
SHA512 f2de22317c4eb897ccfcdfea28c8b5c4506673e6ba6c1828b7b114cdad36906d0b72633c40ea972d2acbdab53aad1c93082c78685e23da75599c4b16c3a5c764
SSDEEP 393216:6tdMdVsjTi8Zg17YbmvIzme0XhK2FQ8YYKXeWfINSW3biLa3L9NJ7W51AmOW1ZEM:TMAY2qYK0Nz3biGRN1+qbwewbkTi
TLSH
T1FFB76B4262A87CD1D036A630DBBB8FF1C769BC555228825F1090FA473D3A783792B7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

763100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\newexeaimsilent\imguiloader-monarch-athena-main\imguiloader-monarch-athena-main\loaderathena\examples\example_win32_directx11\Release\INVINCIBLES X CHEATS.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpQueryHeaders WinHttpSetTimeouts WinHttpCrackUrl WinHttpSetOption WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

kernel32

FindFirstFileExW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter ReadFile SizeofResource GetFileSizeEx GetModuleFileNameW CreateFileW GetFileAttributesW LockResource CloseHandle LoadLibraryW LoadResource FindResourceW ExitProcess GetModuleHandleW WriteProcessMemory GetCurrentProcess WriteFile OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetLastError GetFileAttributesA Process32NextW MoveFileExA CreateFileA DeleteFileA Process32FirstW VirtualAllocEx FindClose GetLocaleInfoEx FlushFileBuffers SetHandleInformation TerminateProcess CreatePipe WaitForSingleObject CreateProcessW GetExitCodeProcess GetModuleFileNameA GetCurrentProcessId CreateProcessA HeapFree FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FindFirstFileW CreateDirectoryW VirtualFreeEx FormatMessageA LocalFree HeapAlloc CreateFileMappingA UnmapViewOfFile GetTickCount MapViewOfFile CreateRemoteThread

user32

DefWindowProcW GetWindowRect DestroyWindow SetClipboardData TrackMouseEvent CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetClipboardData EmptyClipboard DispatchMessageW PeekMessageW MoveWindow CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken

msvcp140

?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __std_exception_destroy longjmp __C_specific_handler memcmp __std_terminate memchr strstr wcsrchr memset memmove memcpy strrchr

api-ms-win-crt-stdio-l1-1-0

fflush fclose __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos ftell fgetc fputc __p__commode __stdio_common_vsnprintf_s _set_fmode fseek __stdio_common_vfprintf __stdio_common_vswprintf_s fwrite __acrt_iob_func __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen

api-ms-win-crt-runtime-l1-1-0

_c_exit _beginthreadex terminate _errno abort _invoke_watson _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _wassert

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy strncmp _wcsicmp strncpy_s _stricmp strcmp

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

sinf powf cosf acosf ceilf sqrtf __setusermatherr

Sharing

Errors

General

Malware Config

Signatures

File Explorer

2026-09-30_abd2363ea53e2f8c857b9686b50c3f22_glassworm_icedid_njrat_vidar

d3d11

d3dcompiler_43

d3dx11_43

winhttp

kernel32

user32

advapi32

msvcp140

imm32

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic