2026-10-01_6e2b270d8145dad993fc5a276e7720cb_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_6e2b270d8145dad993fc5a276e7720cb_cobalt-strike_glassworm_icedid_njrat_vidar
Size 3.9MB
Sample261002-pp7xeswye1
SHA256 a69f5442facf45370bcbd723e8441a75d08a65f96fe715be79175082c928ed60
MD5 6e2b270d8145dad993fc5a276e7720cb
SHA1 e1f9e2be5b6bbdb00e873e6c31c64c944997f888
SHA512 8dfdb8f9ee5918cab9c6294da4f4ad61f47b0af26b129333e9a2fdae77568fbd7ee397523d767f77a9a604fd8a7e4342a2d5ba8177c9010333685d42689dff36
SSDEEP 49152:l7tMt28cJnrN8EFesKber5RlzpuwBif6usY3wb28FNke30jaNf1TWbdz:2prstOwBiCTkU023W
TLSH
T1CF168E2A36A841D9D177D07C898B8B8BEAF174058B318BCF11A5435E2F27AF54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_6e2b270d8145dad993fc5a276e7720cb_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-10-01_6e2b270d8145dad993fc5a276e7720cb_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 3.9MB

2026-10-01_6e2b270d8145dad993fc5a276e7720cb_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 9acd13a6d0083ee858612735ddf9fda4
SHA256 a69f5442facf45370bcbd723e8441a75d08a65f96fe715be79175082c928ed60
MD5 6e2b270d8145dad993fc5a276e7720cb
SHA1 e1f9e2be5b6bbdb00e873e6c31c64c944997f888
SHA512 8dfdb8f9ee5918cab9c6294da4f4ad61f47b0af26b129333e9a2fdae77568fbd7ee397523d767f77a9a604fd8a7e4342a2d5ba8177c9010333685d42689dff36
SSDEEP 49152:l7tMt28cJnrN8EFesKber5RlzpuwBif6usY3wb28FNke30jaNf1TWbdz:2prstOwBiCTkU023W
TLSH
T1CF168E2A36A841D9D177D07C898B8B8BEAF174058B318BCF11A5435E2F27AF54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34961

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\new_jenkins\workspace\lib_TSCloudSDK_windows_cpp_local@2\bin\x64\RelWithDebInfo\CloudScanService.pdb

tslogsdk

LogEx

lib_tscommunication_sdk

close_communication_sdk ts_comm_wait_w ts_comm_signal_r ts_comm_unmap ts_comm_map ts_comm_read ts_comm_write ts_comm_connect init_communication_sdk ts_comm_reset_w

lib_tscloudsdk

TSCloudQueryFilesList TSCloudSwitchAccount TSCloudLoginWithAuth TSCloudInit InitTSCloudSDK TSCloudControlOperation TSCloudRelease

kernel32

CreateSemaphoreExW HeapSize WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetTimeZoneInformation HeapReAlloc GetFileSizeEx SetConsoleCtrlHandler SetFilePointerEx SetEndOfFile SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLastError GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW SetLastError MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW LocalFree FormatMessageA GetLocaleInfoEx CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo SetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl GetModuleHandleW GetProcAddress CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitOnceExecuteOnce RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock SleepConditionVariableCS CreateEventExW RtlUnwind FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait CompareStringEx GetCPInfo GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread SetEnvironmentVariableW GetFileType GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime DuplicateHandle ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP GetStdHandle GetModuleFileNameW GetCommandLineA GetCommandLineW GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

588KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

914B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

671B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_6e2b270d8145dad993fc5a276e7720cb_cobalt-strike_glassworm_icedid_njrat_vidar

tslogsdk

lib_tscommunication_sdk

lib_tscloudsdk

kernel32

generic