2026-10-13_ebee25c96b995eac18b617b5b605d399_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_ebee25c96b995eac18b617b5b605d399_glassworm_icedid_njrat_vidar
Size 3.8MB
Sample261014-crgrssxtas
SHA256 e2d0c7e938e030cb25b6db073e5995ec96f179e6c1488217db0c711fd8186bff
MD5 ebee25c96b995eac18b617b5b605d399
SHA1 b8364161c9734ed15c69add50b35a3e70bc66e4b
SHA512 0ce6ca69f6f34de284e88407c951f23bc082fc54b07f8187095c4749d04fdcd6b0396a54c24edb9b0f14f76398c687f926818bb3d2878cc841d465eacec243ff
SSDEEP 49152:neLRjaim2QFKdAV3cCjHYrwQepcjhfWbS7fIFZaZH4LNiXicJFFRGNzj3:eLAVaKwPsH7wRGpj3
TLSH
T16A068D4ABBE461DDC07AC238C916D159F1B13D6577362ACF12548AAA0F73EF48E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_ebee25c96b995eac18b617b5b605d399_glassworm_icedid_njrat_vidar

File Explorer

2026-10-13_ebee25c96b995eac18b617b5b605d399_glassworm_icedid_njrat_vidar

.exe 3.8MB

2026-10-13_ebee25c96b995eac18b617b5b605d399_glassworm_icedid_njrat_vidar

IMPHASH ed14ceffa979b57c322a480ad56a8a9b
SHA256 e2d0c7e938e030cb25b6db073e5995ec96f179e6c1488217db0c711fd8186bff
MD5 ebee25c96b995eac18b617b5b605d399
SHA1 b8364161c9734ed15c69add50b35a3e70bc66e4b
SHA512 0ce6ca69f6f34de284e88407c951f23bc082fc54b07f8187095c4749d04fdcd6b0396a54c24edb9b0f14f76398c687f926818bb3d2878cc841d465eacec243ff
SSDEEP 49152:neLRjaim2QFKdAV3cCjHYrwQepcjhfWbS7fIFZaZH4LNiXicJFFRGNzj3:eLAVaKwPsH7wRGpj3
TLSH
T16A068D4ABBE461DDC07AC238C916D159F1B13D6577362ACF12548AAA0F73EF48E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1401048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Jamie\Documents\NVIDIA\nvidia-oc\build\Release\gpu_stressor\x64\gpu_stressor.pdb

advapi32

RegOpenKeyExA InitializeSecurityDescriptor OpenEventLogA CloseEventLog RegQueryValueExA ReadEventLogA RegCloseKey SetSecurityDescriptorDacl

shell32

SHGetFolderPathW

nvcuda

cuLaunchKernel cuModuleGetFunction cuModuleLoadData cuOccupancyMaxActiveBlocksPerMultiprocessor cuDeviceGet cuInit cuGetErrorName cuDeviceGetCount cuDeviceGetAttribute cuDevicePrimaryCtxRetain

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID ReleaseSRWLockShared AcquireSRWLockShared InitializeSRWLock HeapFree SetConsoleTextAttribute GetStdHandle GetCurrentThreadId SetEvent WaitForSingleObjectEx CloseHandle HeapAlloc GetProcessHeap CreateEventA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetFileSizeEx FindFirstFileA SetLastError WriteFile FindNextFileA SetEndOfFile FindClose CreateMutexA WaitForSingleObject ReleaseMutex UnmapViewOfFile GetModuleHandleA GetLastError CreateFileA SwitchToThread GetProcAddress SetFilePointerEx CreateFileMappingA LocalFree RemoveDirectoryA GetCurrentProcessId CreateDirectoryA FormatMessageA GetTickCount MapViewOfFileEx GetProcessTimes GetCurrentProcess ReleaseSemaphore DuplicateHandle Sleep GetSystemInfo GetSystemTimeAsFileTime CreateSemaphoreA CreateEventW ResetEvent ExpandEnvironmentStringsA LoadLibraryA FreeLibrary QueryPerformanceCounter HeapCreate HeapDestroy HeapReAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection WakeAllConditionVariable GetCurrentThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetNativeSystemInfo VirtualAlloc VirtualFree VirtualProtect FreeLibraryAndExitThread GetProcessAffinityMask SetThreadAffinityMask GetModuleHandleW LoadLibraryExW CreateProcessW LocalAlloc CreateProcessA GetSystemDirectoryW GetFullPathNameW VerifyVersionInfoW VerSetConditionMask GetModuleFileNameW CreateFileW lstrcmpA OutputDebugStringW MultiByteToWideChar WideCharToMultiByte GetExitCodeThread CreateDirectoryW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI RtlPcToFileHeader EncodePointer DecodePointer RaiseException QueueUserWorkItem GetModuleHandleExW IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SleepConditionVariableSRW GetCurrentDirectoryW GetFileAttributesW DeviceIoControl OpenEventA GetLogicalProcessorInformation InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetVersionExW InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW IsValidLocale RtlUnwindEx ExitProcess GetFileType WriteConsoleW SetStdHandle ReadFile ExitThread SetEnvironmentVariableW GetDateFormatW GetTimeFormatW HeapSize

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

542KB

Virtual Size

541KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

296KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nv_fatb

Size

537KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nvFatBi

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=72, id=260, version=25711,

count=29, id=259, version=25711,

count=199, id=261, version=25711,

count=2, id=257, version=25711,

count=10, id=259, version=25305,

count=36, id=261, productName=VS2017 v15.7.4 build 26431, version=26431,

count=124, id=261, version=25305,

count=39, id=260, version=25305,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=234, id=1, productName=Unmarked objects,

count=5, id=203, version=65501,

count=15, id=207, productName=VS2012 build 50727, version=50727,

count=20, id=261, productName=VS2017 v15.4.5 build 25547, version=25547,

count=9, id=265, version=25547,

count=1, id=256, productName=VS2017 v15.4.5 build 25547, version=25547,

count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,

count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,