2026-10-01_659692e2a668ae79c6af97872b8c6238_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_659692e2a668ae79c6af97872b8c6238_cobalt-strike_glassworm_icedid_njrat_vidar
Size 2.1MB
Sample261002-qfbcjatgnd
SHA256 50e9d53c9598796e8a5f60e102aafb689c125eadf954a5385375dd8db5d5ce2f
MD5 659692e2a668ae79c6af97872b8c6238
SHA1 d32aad55b32065690f9c6ee587fb3fc314fde1f9
SHA512 ae9b2338a9ddc6b2621b4a1ccd39e7e2d67afe2b7581b971033da84fbee5266a33cd61831bf2280697d08071af8e735ae919aed507e47e4a4ee48a9280a8050e
SSDEEP 24576:iTIiGOUZQ10x+i/5GSnXNQ6/OD4TwHsRjPjW5mgXe4i7ojhsP5Lgrk1TWb4AN5:rROrPi/dhXwHPe30jaNf1TWbdz
TLSH
T1A9A5BF27379C41C5E1B7927C89878F4AD6B174060B319BCF01A547AE2F27AE94E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_659692e2a668ae79c6af97872b8c6238_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-10-01_659692e2a668ae79c6af97872b8c6238_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 2.1MB

2026-10-01_659692e2a668ae79c6af97872b8c6238_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 25f7ab2e9dca946fd2df78f19061653d
SHA256 50e9d53c9598796e8a5f60e102aafb689c125eadf954a5385375dd8db5d5ce2f
MD5 659692e2a668ae79c6af97872b8c6238
SHA1 d32aad55b32065690f9c6ee587fb3fc314fde1f9
SHA512 ae9b2338a9ddc6b2621b4a1ccd39e7e2d67afe2b7581b971033da84fbee5266a33cd61831bf2280697d08071af8e735ae919aed507e47e4a4ee48a9280a8050e
SSDEEP 24576:iTIiGOUZQ10x+i/5GSnXNQ6/OD4TwHsRjPjW5mgXe4i7ojhsP5Lgrk1TWb4AN5:rROrPi/dhXwHPe30jaNf1TWbdz
TLSH
T1A9A5BF27379C41C5E1B7927C89878F4AD6B174060B319BCF01A547AE2F27AE94E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20641

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Jenkins\WorkSpace\workspace\lib_TSMediaPlayerSDK\bin\x64\RelWithDebInfo\MediaInfoService.pdb

lib_tsmediaplayersdk

InitBugsplat InitTSMediaPlayer

tslogsdk

LogEx

sdl2

SDL_Quit SDL_Init SDL_GetError

kernel32

ResetEvent WriteConsoleW SetEndOfFile HeapSize ReadConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW SetErrorMode FlushFileBuffers ReadFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW WriteFile GlobalMemoryStatusEx GetSystemInfo GetModuleHandleW GetProcAddress GetOEMCP WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA WideCharToMultiByte MultiByteToWideChar InitOnceExecuteOnce QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW LocalFree EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetLocaleInfoEx GetStringTypeW InitializeCriticalSectionAndSpinCount SetEvent RtlUnwind CreateEventW GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapFree GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapAlloc GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetStdHandle HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_659692e2a668ae79c6af97872b8c6238_cobalt-strike_glassworm_icedid_njrat_vidar

lib_tsmediaplayersdk

tslogsdk

sdl2

kernel32

generic