2026-10-01_4e12a1c6855a17c5d63435bdb064a50a_cobalt-strike_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_4e12a1c6855a17c5d63435bdb064a50a_cobalt-strike_glassworm_icedid_njrat_vidar
Size 5.3MB
Sample261002-sejcvssdla
SHA256 86445a723f714dec5322067de42b5ca0eb88ebf104169197b1cd90022b868b47
MD5 4e12a1c6855a17c5d63435bdb064a50a
SHA1 10b9538af5c95e88c0f5965b0f5774fc2a1904ac
SHA512 de8ebf2d5fb8ae45bf00800c38c063af7d59a498ac5d5515fc7a8fbcd9f33bb5ba41211a2d2912167604bf56bb007e1d8a7fa19cd7e25e093dc8bb566f5ce5ea
SSDEEP 49152:vrfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysetnDdlH8wQAxx22dqhl9qPURPGO:9152Ost7H87oS9qMRPjJq
TLSH
T1EF46281633F81388E1F7867C96B75616CA76BC198B21C7CF0160915E1E33AE58D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_4e12a1c6855a17c5d63435bdb064a50a_cobalt-strike_glassworm_icedid_njrat_vidar

File Explorer

2026-10-01_4e12a1c6855a17c5d63435bdb064a50a_cobalt-strike_glassworm_icedid_njrat_vidar

.exe 5.3MB

2026-10-01_4e12a1c6855a17c5d63435bdb064a50a_cobalt-strike_glassworm_icedid_njrat_vidar

IMPHASH 23b5eb1fe80ddbb4b2cbba1be709edba
SHA256 86445a723f714dec5322067de42b5ca0eb88ebf104169197b1cd90022b868b47
MD5 4e12a1c6855a17c5d63435bdb064a50a
SHA1 10b9538af5c95e88c0f5965b0f5774fc2a1904ac
SHA512 de8ebf2d5fb8ae45bf00800c38c063af7d59a498ac5d5515fc7a8fbcd9f33bb5ba41211a2d2912167604bf56bb007e1d8a7fa19cd7e25e093dc8bb566f5ce5ea
SSDEEP 49152:vrfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysetnDdlH8wQAxx22dqhl9qPURPGO:9152Ost7H87oS9qMRPjJq
TLSH
T1EF46281633F81388E1F7867C96B75616CA76BC198B21C7CF0160915E1E33AE58D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26491

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\76724\LVInstaller\VideofusionInstaller\src\JIanyingInstaller\x64\CC_RELEASE\JianyingLauncher.pdb

dbghelp

SymCleanup SymFunctionTableAccess64 SymGetModuleBase64 SymSetOptions SymInitialize SymGetSearchPathW SymSetSearchPathW SymFromAddr SymGetLineFromAddr64 StackWalk64

propsys

InitPropVariantFromCLSID

ws2_32

ioctlsocket

setupapi

CM_Get_Device_IDW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

winmm

timeEndPeriod timeGetTime timeBeginPeriod

kernel32

WaitForSingleObject OpenProcess GetWindowsDirectoryW FreeLibrary LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetCurrentThread GetCurrentDirectoryW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime DecodePointer InitializeCriticalSectionEx DeleteCriticalSection GetFileInformationByHandle GetLocalTime GetTickCount CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime ProcessIdToSessionId GetCommandLineW GetEnvironmentVariableW CreateFileA GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetTempPathW GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetVersion GetSystemDirectoryW LocalAlloc lstrcmpW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW CopyFileW MoveFileExW WTSGetActiveConsoleSessionId OutputDebugStringA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent CreateEventW CreateThread MoveFileW SetEnvironmentVariableW InitializeCriticalSectionAndSpinCount Sleep OpenMutexA GetCurrentThreadId K32EnumProcessModules SetCurrentDirectoryW GetFileAttributesExW GetFinalPathNameByHandleW GetLogicalDriveStringsW GetVolumePathNameW DuplicateHandle GetModuleHandleA ReplaceFileW CreateHardLinkW FindFirstFileExW GetProcessId FormatMessageA LoadLibraryExW GetModuleHandleExW GetNativeSystemInfo GetProductInfo IsWow64Process ReleaseSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime GetProcAddress SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime GetVersionExW GetFileSizeEx LockFileEx SetEndOfFile SetFileInformationByHandle SetFilePointerEx UnlockFileEx UnregisterWaitEx RegisterWaitForSingleObject IsDebuggerPresent GetThreadId GetUserDefaultLangID AcquireSRWLockExclusive lstrcmpiA GlobalMemoryStatusEx WaitForMultipleObjects TlsGetValue VirtualAlloc VirtualFree FlushViewOfFile VirtualQuery GetProcessTimes SetPriorityClass GetPriorityClass HeapSetInformation GetSystemInfo GetProcessIoCounters K32GetPerformanceInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsSetValue TlsAlloc TlsFree RtlCaptureStackBackTrace SetUnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetInformationJobObject GetModuleHandleExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce RtlVirtualUnwind VirtualProtect LoadLibraryExA OutputDebugStringW WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableCS FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer TryEnterCriticalSection InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx LocalFree QueryThreadCycleTime GetStringTypeW CompareStringEx GetCPInfo RtlPcToFileHeader RtlUnwindEx GetModuleHandleW SetLastError DeviceIoControl GetDateFormatW SetFileAttributesW GetLongPathNameW GetFullPathNameW ExpandEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar CloseHandle WriteFile ReadFile GetFileSize CreateFileW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait IsValidLocale GetUserDefaultLCID GetFileInformationByHandleEx CreateSymbolicLinkW EnumSystemLocalesW ReadConsoleW GetDriveTypeW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers WriteConsoleW GetStdHandle ExitProcess GetConsoleMode GetConsoleOutputCP GetFileType SetStdHandle SetConsoleCtrlHandler InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetLocaleInfoEx

user32

SetTimer GetQueueStatus PostQuitMessage MsgWaitForMultipleObjectsEx PeekMessageW DefWindowProcW TranslateMessage CharUpperW SetProcessDPIAware RemovePropW SetPropW GetSystemMetrics GetUserObjectInformationW GetThreadDesktop GetWindowThreadProcessId GetClassNameW EnumWindows GetWindowLongW GetWindowTextLengthW GetWindowTextW PostMessageW ExitWindowsEx UnregisterClassW GetDesktopWindow GetDC RegisterClassExW CreateWindowExW DestroyWindow GetWindowLongPtrW SetWindowLongPtrW FindWindowExW KillTimer DispatchMessageW

advapi32

GetSidSubAuthorityCount SystemFunction036 RegNotifyChangeKeyValue RegEnumValueW RegDeleteValueW ConvertSidToStringSidW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteKeyExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl MapGenericMask IsValidSecurityDescriptor InitializeSecurityDescriptor ImpersonateLoggedOnUser GetFileSecurityW FreeSid EqualSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck LookupPrivilegeValueW RevertToSelf ImpersonateSelf AdjustTokenPrivileges OpenThreadToken SetThreadToken ConvertStringSidToSidW LookupAccountSidW SetTokenInformation GetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW SetNamedSecurityInfoW GetNamedSecurityInfoW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce

ole32

CoInitialize CoRevokeInitializeSpy CoRegisterInitializeSpy CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitializeEx PropVariantClear

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathW SHGetFolderPathA SHGetSpecialFolderPathW

oleaut32

VariantClear SysStringLen SysAllocString SysFreeString

shlwapi

StrToIntW ord437 PathMatchSpecW ord176 SHSetValueW StrChrW StrCmpNW StrCmpNIW StrRChrW StrCmpIW StrCpyNW SHGetValueW PathAppendW PathRemoveFileSpecW PathIsDirectoryW PathGetDriveNumberW PathFindExtensionW PathAddBackslashW PathFileExistsW

gdi32

DeleteObject GetDeviceCaps

userenv

CreateEnvironmentBlock UnloadUserProfile LoadUserProfileW DestroyEnvironmentBlock

mpr

WNetGetResourceInformationW

psapi

EnumProcessModules GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

iphlpapi

GetAdaptersAddresses

??0MemoryAllocatorDumpGuid@trace_event@base@@QEAA@_K@Z ??0ReadOnlySharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??0UnsafeSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0UnsafeSharedMemoryRegion@base@@QEAA@XZ ??0WritableSharedMemoryRegion@base@@AEAA@VPlatformSharedMemoryRegion@subtle@1@@Z ??0WritableSharedMemoryRegion@base@@QEAA@$$QEAV01@@Z ??0WritableSharedMemoryRegion@base@@QEAA@XZ ??1ReadOnlySharedMemoryRegion@base@@QEAA@XZ ??1UnsafeSharedMemoryRegion@base@@QEAA@XZ ??1WritableSharedMemoryRegion@base@@QEAA@XZ ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@$$QEAV012@@Z ??4MemoryAllocatorDumpGuid@trace_event@base@@QEAAAEAV012@AEBV012@@Z ??4ReadOnlySharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4UnsafeSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??4WritableSharedMemoryRegion@base@@QEAAAEAV01@$$QEAV01@@Z ??8MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??9MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ??MMemoryAllocatorDumpGuid@trace_event@base@@QEBA_NAEBV012@@Z ?ConvertToReadOnly@WritableSharedMemoryRegion@base@@SA?AVReadOnlySharedMemoryRegion@2@V12@@Z ?ConvertToUnsafe@WritableSharedMemoryRegion@base@@SA?AVUnsafeSharedMemoryRegion@2@V12@@Z ?Create@ReadOnlySharedMemoryRegion@base@@SA?AUMappedReadOnlyRegion@2@_K@Z ?Create@UnsafeSharedMemoryRegion@base@@SA?AV12@_K@Z ?Create@WritableSharedMemoryRegion@base@@SA?AV12@_K@Z ?Deserialize@ReadOnlySharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@UnsafeSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Deserialize@WritableSharedMemoryRegion@base@@SA?AV12@VPlatformSharedMemoryRegion@subtle@2@@Z ?Duplicate@ReadOnlySharedMemoryRegion@base@@QEBA?AV12@XZ ?Duplicate@UnsafeSharedMemoryRegion@base@@QEBA?AV12@XZ ?GetGUID@ReadOnlySharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@UnsafeSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetGUID@WritableSharedMemoryRegion@base@@QEBAAEBVUnguessableToken@2@XZ ?GetPlatformHandle@ReadOnlySharedMemoryRegion@base@@QEBAPEAXXZ ?GetPlatformHandle@UnsafeSharedMemoryRegion@base@@QEBAPEAXXZ ?GetSize@ReadOnlySharedMemoryRegion@base@@QEBA_KXZ ?GetSize@UnsafeSharedMemoryRegion@base@@QEBA_KXZ ?GetSize@WritableSharedMemoryRegion@base@@QEBA_KXZ ?IsValid@ReadOnlySharedMemoryRegion@base@@QEBA_NXZ ?IsValid@UnsafeSharedMemoryRegion@base@@QEBA_NXZ ?IsValid@WritableSharedMemoryRegion@base@@QEBA_NXZ ?Map@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@XZ ?Map@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?Map@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@XZ ?MapAt@ReadOnlySharedMemoryRegion@base@@QEBA?AVReadOnlySharedMemoryMapping@2@J_K@Z ?MapAt@UnsafeSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?MapAt@WritableSharedMemoryRegion@base@@QEBA?AVWritableSharedMemoryMapping@2@J_K@Z ?TakeHandleForSerialization@ReadOnlySharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@UnsafeSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?TakeHandleForSerialization@WritableSharedMemoryRegion@base@@SA?AVPlatformSharedMemoryRegion@subtle@2@V12@@Z ?ThrowBadVariantAccess@variant_internal@absl@@YAXXZ ?ToUint64@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_KXZ ?UnsafeGetPlatformHandle@WritableSharedMemoryRegion@base@@QEBAPEAXXZ ?create_hook_@ReadOnlySharedMemoryRegion@base@@0P6A?AUMappedReadOnlyRegion@2@_K@ZEA ?create_hook_@UnsafeSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?create_hook_@WritableSharedMemoryRegion@base@@0P6A?AV12@_K@ZEA ?empty@MemoryAllocatorDumpGuid@trace_event@base@@QEBA_NXZ ?g_swallow_stream@logging@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@EA ?kDisableBestEffortTasks@switches@@3QBDB ?kDisableBreakpad@switches@@3QBDB ?kDisableFeatures@switches@@3QBDB ?kDisableHighResTimer@switches@@3QBDB ?kDisableLowEndDeviceMode@switches@@3QBDB ?kDisableUsbKeyboardDetect@switches@@3QBDB ?kEnableBackgroundThreadPool@switches@@3QBDB ?kEnableCrashReporter@switches@@3QBDB ?kEnableFeatures@switches@@3QBDB ?kEnableLowEndDeviceMode@switches@@3QBDB ?kForceFieldTrials@switches@@3QBDB ?kFullMemoryCrashReport@switches@@3QBDB ?kLogBestEffortTasks@switches@@3QBDB ?kNoErrorDialogs@switches@@3QBDB ?kProfilingAtStart@switches@@3QBDB ?kProfilingFile@switches@@3QBDB ?kProfilingFlush@switches@@3QBDB ?kTestChildProcess@switches@@3QBDB ?kTestDoNotInitializeIcu@switches@@3QBDB ?kTraceToFile@switches@@3QBDB ?kTraceToFileName@switches@@3QBDB ?kV@switches@@3QBDB ?kVModule@switches@@3QBDB ?kWaitForDebugger@switches@@3QBDB ?set_create_hook@ReadOnlySharedMemoryRegion@base@@CAXP6A?AUMappedReadOnlyRegion@2@_K@Z@Z ?set_create_hook@UnsafeSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?set_create_hook@WritableSharedMemoryRegion@base@@CAXP6A?AV12@_K@Z@Z ?throw_bad_optional_access@optional_internal@absl@@YAXXZ GetHandleVerifier

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

minATL

Size

1024B

Virtual Size

809B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_4e12a1c6855a17c5d63435bdb064a50a_cobalt-strike_glassworm_icedid_njrat_vidar

dbghelp

propsys

ws2_32

setupapi

winmm

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

userenv

mpr

psapi

iphlpapi

generic