2026-10-16_2405185fa0e16cda82e2d8e6a1f4778d_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_2405185fa0e16cda82e2d8e6a1f4778d_glassworm_icedid_njrat
Size 33.6MB
Sample261017-1l8kbsdz21
SHA256 c11acead5169a2b2d1e988b9da5ed6f8ee7824fe8deee72e8958772fa411297a
MD5 2405185fa0e16cda82e2d8e6a1f4778d
SHA1 6952e525c3300428c1edde1ef46c7f49d52896c6
SHA512 306be5843e15719f632a62be75d575b85388d06d22b8172aeaa4d4368dffc1bd0cbb231966d1a38d21ac5b207f1cf52c165702472b3c93e33483b3de3ac4b9fc
SSDEEP 49152:dirZ9Lsr6LMeZ89b0irLc80CX6NqjeCZzZ+4m+b7qQ2S3nHPqGfHZbHKX0887/6f:IEfclST0zKihubcGlQSmoaM34/ydAD
TLSH
T137775106F7B61D92F0F6C23A83622A11B9313C7ADB3457BB8641671EAF7D38095B9311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_2405185fa0e16cda82e2d8e6a1f4778d_glassworm_icedid_njrat

File Explorer

2026-10-16_2405185fa0e16cda82e2d8e6a1f4778d_glassworm_icedid_njrat

.exe 33.6MB

2026-10-16_2405185fa0e16cda82e2d8e6a1f4778d_glassworm_icedid_njrat

IMPHASH f564dc8c30038f8aa7d3b014731dce6b
SHA256 c11acead5169a2b2d1e988b9da5ed6f8ee7824fe8deee72e8958772fa411297a
MD5 2405185fa0e16cda82e2d8e6a1f4778d
SHA1 6952e525c3300428c1edde1ef46c7f49d52896c6
SHA512 306be5843e15719f632a62be75d575b85388d06d22b8172aeaa4d4368dffc1bd0cbb231966d1a38d21ac5b207f1cf52c165702472b3c93e33483b3de3ac4b9fc
SSDEEP 49152:dirZ9Lsr6LMeZ89b0irLc80CX6NqjeCZzZ+4m+b7qQ2S3nHPqGfHZbHKX0887/6f:IEfclST0zKihubcGlQSmoaM34/ydAD
TLSH
T137775106F7B61D92F0F6C23A83622A11B9313C7ADB3457BB8641671EAF7D38095B9311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16054512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Sandbox\Stroika\DevRoot\Builds\Debug\Tests\Test18.pdb

kernel32

GetLastError MultiByteToWideChar WideCharToMultiByte OutputDebugStringA OutputDebugStringW GetCurrentProcessId LoadLibraryExW LocalFree FormatMessageA IsDebuggerPresent DebugBreak GetModuleFileNameW GetModuleHandleW QueueUserAPC SetThreadPriority SetThreadDescription GetLocalTime FileTimeToSystemTime SleepEx GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW SetStdHandle WriteFile SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW ReadFile WriteConsoleW GetFileType SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread ExitProcess IsProcessorFeaturePresent GetModuleHandleExW RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry PssQuerySnapshot PssFreeSnapshot PssCaptureSnapshot GetProcessId TerminateProcess GetTempFileNameW CreateFileW GetEnvironmentVariableW VirtualQuery GetProcessHeap HeapFree HeapAlloc GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx FreeLibrary RtlCaptureStackBackTrace WakeAllConditionVariable WakeConditionVariable CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW GetProcAddress DeviceIoControl AreFileApisANSI CreateFile2 GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW InitOnceComplete InitOnceBeginInitialize GetStringTypeW GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive RaiseException RtlPcToFileHeader GetLocaleInfoEx CloseThreadpoolWork WaitForThreadpoolWorkCallbacks SubmitThreadpoolWork CreateThreadpoolWork GetLogicalProcessorInformationEx GetExitCodeThread SwitchToThread WaitForSingleObjectEx GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter FormatMessageW SetConsoleTextAttribute GetConsoleScreenBufferInfo GetModuleFileNameA OpenProcess CreateProcessA ResumeThread GetThreadPriority OpenThread GetCurrentThreadId GetCurrentThread CreateThread GetExitCodeProcess GetCurrentProcess WaitForMultipleObjects Sleep CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreatePipe SetErrorMode DuplicateHandle CloseHandle GetTempFileNameA GetTempPathA GetCommandLineA SetEnvironmentVariableW GetStdHandle DeleteFileW SetEndOfFile

ws2_32

ntohs htons inet_ntop inet_pton

clang_rt.asan_dynamic-x86_64

__asan_new __asan_wrap_memchr __asan_wrap_memcmp __asan_store2 __asan_load2 __asan_unregister_globals __asan_register_globals __asan_wrap_static_crt__aligned_offset_recalloc_dbg __asan_wrap_static_crt__aligned_offset_recalloc __asan_wrap_static_crt__aligned_recalloc_dbg __asan_wrap_static_crt__aligned_recalloc __asan_wrap_static_crt__aligned_offset_realloc_dbg __asan_wrap_static_crt__aligned_offset_realloc __asan_wrap_static_crt__aligned_realloc_dbg __asan_wrap_static_crt__aligned_realloc __asan_wrap_static_crt__aligned_free_dbg __asan_wrap_static_crt__aligned_free __asan_wrap__aligned_offset_malloc_dbg __asan_wrap__aligned_offset_malloc __asan_wrap__aligned_malloc_dbg __asan_wrap__aligned_malloc __asan_wrap_static_crt__aligned_msize_dbg __asan_wrap_static_crt__aligned_msize __asan_wrap_static_crt__expand_dbg __asan_wrap_static_crt__expand __asan_wrap_static_crt__recalloc_dbg __asan_wrap_static_crt__recalloc_base __asan_wrap_static_crt__recalloc __asan_wrap_static_crt__realloc_dbg __asan_wrap_static_crt__realloc_base __asan_wrap_static_crt_realloc __asan_wrap__calloc_dbg __asan_wrap__calloc_base __asan_wrap_calloc __asan_wrap__malloc_dbg __asan_wrap__malloc_base __asan_wrap_malloc __asan_wrap_static_crt__free_dbg __asan_wrap_static_crt__free_base __asan_wrap_static_crt_free __asan_wrap_static_crt__msize_dbg __asan_wrap_static_crt__msize_base __asan_wrap_static_crt__msize __sanitizer_get_ownership __asan_set_seh_filter __asan_get_shadow_memory_dynamic_address __asan_should_detect_stack_use_after_return __asan_on_error__dll __asan_default_suppressions__dll __asan_default_options__dll __asan_wrap_wcsnlen __asan_wrap_wcslen __asan_wrap_static_crt_strtoll __asan_wrap_static_crt_strtol __asan_wrap_strtok __asan_wrap_strspn __asan_wrap_strpbrk __asan_wrap_strnlen __asan_wrap_wcsncpy __asan_wrap_strncpy __asan_wrap_strncmp __asan_wrap_wcsncat __asan_wrap_strncat __asan_wrap__strdup __asan_wrap_strcspn __asan_wrap_wcscpy __asan_wrap_strcpy __asan_wrap_strcmp __asan_delete __asan_wrap_strcat __asan_wrap_frexp __asan_delete_size __asan_wrap_static_crt_atoi __asan_wrap_static_crt_atol __sanitizer_cov_pcs_cleanup__dll __sanitizer_cov_pcs_init__dll __sanitizer_cov_bool_flag_init__dll __sanitizer_cov_8bit_counters_cleanup__dll __sanitizer_cov_8bit_counters_init__dll __sanitizer_cov_trace_switch__dll __sanitizer_cov_store16__dll __sanitizer_cov_store8__dll __sanitizer_cov_store4__dll __sanitizer_cov_store2__dll __sanitizer_cov_store1__dll __sanitizer_cov_load16__dll __sanitizer_cov_load8__dll __sanitizer_cov_load4__dll __sanitizer_cov_load2__dll __sanitizer_cov_load1__dll __sanitizer_cov_trace_pc_indir__dll __sanitizer_cov_trace_pc_guard_cleanup__dll __sanitizer_cov_trace_pc_guard_init__dll __sanitizer_cov_trace_pc_guard__dll __sanitizer_cov_trace_gep__dll __sanitizer_cov_trace_div8__dll __sanitizer_cov_trace_div4__dll __sanitizer_cov_trace_const_cmp8__dll __sanitizer_cov_trace_const_cmp4__dll __sanitizer_cov_trace_const_cmp2__dll __sanitizer_cov_trace_const_cmp1__dll __sanitizer_cov_trace_cmp8__dll __sanitizer_cov_trace_cmp4__dll __sanitizer_cov_trace_cmp2__dll __sanitizer_cov_trace_cmp1__dll __sanitizer_cov_trace_cmp__dll __sancov_default_options__dll __sanitizer_ignore_free_hook__dll __sanitizer_malloc_hook__dll __sanitizer_free_hook__dll __sanitizer_weak_hook_strstr__dll __sanitizer_weak_hook_strncmp__dll __sanitizer_weak_hook_strcmp__dll __sanitizer_weak_hook_memcmp__dll __sanitizer_get_dtls_size__dll __sanitizer_sandbox_on_notify__dll __sanitizer_report_error_summary__dll __sanitizer_on_print__dll __sanitizer_register_weak_function __sanitizer_override_function __asan_wrap_strlen __asan_storeN __asan_store8 __asan_store4 __asan_store16 __asan_store1 __asan_set_shadow_f8 __asan_set_shadow_00 __asan_report_store8 __asan_report_store4 __asan_report_store2 __asan_report_store16 __asan_report_store1 __asan_report_load8 __asan_report_load4 __asan_report_load2 __asan_report_load16 __asan_report_load1 __asan_memset __asan_memcpy __asan_loadN __asan_load8 __asan_load4 __asan_load16 __asan_load1 __sanitizer_annotate_contiguous_container __asan_unpoison_memory_region __asan_poison_memory_region __asan_new_array __asan_new_nothrow __asan_get_report_description __asan_new_array_nothrow __asan_wrap_static_crt_atoll __asan_wrap_wcscat __asan_delete_array __asan_set_error_report_callback

wininet

InternetGetConnectedState

dbghelp

UnDecorateSymbolName

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

DispatchMessageW IsDialogMessageW MsgWaitForMultipleObjectsEx PeekMessageW TranslateMessage

Name

.text

Size

16.7MB

Virtual Size

16.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.8MB

Virtual Size

11.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

712KB

Virtual Size

712KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.WEAK

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.INTR

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

576KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_2405185fa0e16cda82e2d8e6a1f4778d_glassworm_icedid_njrat

kernel32

ws2_32

clang_rt.asan_dynamic-x86_64

wininet

dbghelp

api-ms-win-core-synch-l1-2-0

user32

generic