2026-10-22_de06c33df04d8c7a19883814858c4c13_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_de06c33df04d8c7a19883814858c4c13_glassworm_icedid_njrat_vidar
Size 3.6MB
Sample261023-vgl8msfs2k
SHA256 4c6c93d417285bb3c5c77ab907ab7289988118e10e341c1a9f5049796f9945f8
MD5 de06c33df04d8c7a19883814858c4c13
SHA1 6a7fde1557cecdee0e88a23da7952908dcdfdfb4
SHA512 19e97a61b1c084d92c52b1e77eec2669e6c46f32d23cefddffc902b8873346ce684250d21e55d36d6ddfd94a896cf15fd287367763091b1a6038dc1cc675f8d2
SSDEEP 98304:gMc40QoaoYJkg3HXNdqOfmEyH/+8aIu7OoYC15Z1tA5zjUA0BntQEA+Ya6ujglxI:5c40koYJkg3HXNdqOfmEyH/+8aIu7OoW
TLSH
T1FD067C1ABAA440F5C0A7C178895ACE8AE7B17C415F7187CF1260765E1F3BAF64E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_de06c33df04d8c7a19883814858c4c13_glassworm_icedid_njrat_vidar

File Explorer

2026-10-22_de06c33df04d8c7a19883814858c4c13_glassworm_icedid_njrat_vidar

.exe 3.6MB

2026-10-22_de06c33df04d8c7a19883814858c4c13_glassworm_icedid_njrat_vidar

IMPHASH 6fc6be32f06c76af63a0b13ab5e5add0
SHA256 4c6c93d417285bb3c5c77ab907ab7289988118e10e341c1a9f5049796f9945f8
MD5 de06c33df04d8c7a19883814858c4c13
SHA1 6a7fde1557cecdee0e88a23da7952908dcdfdfb4
SHA512 19e97a61b1c084d92c52b1e77eec2669e6c46f32d23cefddffc902b8873346ce684250d21e55d36d6ddfd94a896cf15fd287367763091b1a6038dc1cc675f8d2
SSDEEP 98304:gMc40QoaoYJkg3HXNdqOfmEyH/+8aIu7OoYC15Z1tA5zjUA0BntQEA+Ya6ujglxI:5c40koYJkg3HXNdqOfmEyH/+8aIu7OoW
TLSH
T1FD067C1ABAA440F5C0A7C178895ACE8AE7B17C415F7187CF1260765E1F3BAF64E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1123556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\IPM_git\bin\x64\Release\WZUpdateNotifier.pdb

kernel32

GetEnvironmentVariableA GetEnvironmentVariableW GetCurrentDirectoryA GetFileAttributesW OutputDebugStringA SetLastError SuspendThread ResumeThread GetThreadContext ReadProcessMemory GetModuleFileNameA InitializeCriticalSectionAndSpinCount TerminateThread CreateEventW WaitForMultipleObjects OpenThread GetLocaleInfoW GetUserDefaultUILanguage RemoveDirectoryW GlobalAlloc GlobalLock GlobalUnlock MulDiv lstrcmpW GetBinaryTypeW MoveFileExW CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetTempFileNameW ResetEvent ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation GetModuleHandleA CreateWaitableTimerA InitializeCriticalSection CreateSemaphoreA GlobalFree GetModuleHandleExW RaiseException GetLastError HeapDestroy RtlUnwind GetVersionExA GetLocalTime GetCurrentThread SetUnhandledExceptionFilter CreateFileW WaitForSingleObjectEx GetCurrentProcess ExpandEnvironmentStringsW SetEnvironmentVariableW TerminateProcess Process32NextW Process32FirstW HeapAlloc HeapReAlloc lstrlenA lstrlenW DosDateTimeToFileTime SetFilePointer SetFileInformationByHandle LocalFileTimeToFileTime GetFileSize LocalAlloc WriteConsoleW SetStdHandle CreateToolhelp32Snapshot FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP WriteFile GetStdHandle ExitProcess ExitThread RtlUnwindEx RtlPcToFileHeader CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList DuplicateHandle VirtualProtect GetVersionExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait AreFileApisANSI OpenProcess ProcessIdToSessionId CreateProcessW GetExitCodeProcess QueryDosDeviceW GetLogicalDriveStringsW GetCurrentThreadId Sleep WTSGetActiveConsoleSessionId LoadLibraryW GetTickCount VerifyVersionInfoW DeviceIoControl SetFilePointerEx SetEndOfFile GetFileAttributesExW FindNextFileW SetCurrentDirectoryW GetUserDefaultLCID GetStringTypeExW LoadLibraryA GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent LCMapStringW CompareStringW GetSystemTimeAsFileTime SwitchToThread EncodePointer GetCPInfo TryEnterCriticalSection GetStringTypeW RtlCaptureContext VerSetConditionMask SetEnvironmentVariableA DecodePointer CreateMutexW HeapFree WaitForSingleObject ReleaseMutex GetUserDefaultLangID FormatMessageW LocalFree GetCurrentProcessId CreateEventA SetEvent QueryPerformanceFrequency QueryPerformanceCounter CloseHandle GetTempPathW WideCharToMultiByte MultiByteToWideChar FindResourceW lstrcmpiW SizeofResource LockResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW LeaveCriticalSection EnterCriticalSection GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize

user32

GetWindow SystemParametersInfoW MonitorFromWindow GetMonitorInfoW EndDialog GetClassNameW GetAncestor GetShellWindow GetTopWindow GetWindowRect GetForegroundWindow GetLastInputInfo GetActiveWindow IsWindowVisible IsWindow CharNextW UnregisterClassW DialogBoxParamW MonitorFromPoint FindWindowW IsRectEmpty IntersectRect CopyRect SetRectEmpty FillRect SendMessageW SetWindowPos GetDC BeginPaint EndPaint SetPropW GetPropW GetClientRect ScreenToClient GetWindowLongW SetWindowLongW SetWindowLongPtrW GetParent EnumChildWindows GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW GetSysColor ClientToScreen GetWindowTextLengthW GetWindowTextW RedrawWindow InvalidateRgn ReleaseDC DestroyAcceleratorTable PostThreadMessageW DestroyWindow TrackMouseEvent IsWindowEnabled SetCursor DrawIconEx GetIconInfo LoadImageW CreateAcceleratorTableW KillTimer CreateDialogParamW SetWindowTextW MapWindowPoints ShowWindow DestroyIcon RegisterClassExW GetClassInfoExW CreateWindowExW LoadCursorW DefWindowProcW CallWindowProcW InvalidateRect GetWindowLongPtrW RegisterWindowMessageW IsChild MoveWindow GetDlgItem SetFocus GetFocus GetKeyState GetDesktopWindow SetTimer ReleaseCapture LoadStringW DestroyCursor SetCapture

gdi32

SelectObject DeleteObject DeleteDC CreateSolidBrush CreateCompatibleBitmap BitBlt GetDeviceCaps GetStockObject GetObjectW RestoreDC SaveDC StretchBlt SetStretchBltMode GetBitmapBits CreateCompatibleDC

shell32

SHCreateDirectoryExW DuplicateIcon ShellExecuteExW SHGetFolderPathW ExtractIconExW ShellExecuteW

ole32

CoUnmarshalInterface CoMarshalInterface OleLockRunning OleUninitialize OleInitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString CoGetClassObject CreateStreamOnHGlobal CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoTaskMemRealloc

oleaut32

SafeArrayUnaccessData SysFreeString VariantClear OleCreateFontIndirect SysAllocString VariantInit SysStringLen SysStringByteLen SysAllocStringByteLen VariantChangeType LoadRegTypeLi VarUI4FromStr LoadTypeLi SafeArrayCreate SysAllocStringLen VariantCopy SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData DispCallFunc

advapi32

CryptDestroyHash CryptDestroyKey CryptDeriveKey CryptReleaseContext RegOpenKeyW UnlockServiceDatabase LockServiceDatabase CryptDecrypt CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextW GetUserNameA LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW ConvertStringSidToSidW LookupAccountSidW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shlwapi

PathFileExistsW UrlEscapeW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoSizeA GetFileVersionInfoA

msimg32

AlphaBlend

powrprof

CallNtPowerInformation

psapi

GetProcessImageFileNameW

winhttp

WinHttpAddRequestHeaders WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpOpenRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpSetCredentials WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpGetDefaultProxyConfiguration

wininet

InternetGetConnectedState HttpAddRequestHeadersW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetOpenW HttpSendRequestW InternetQueryDataAvailable InternetReadFile InternetConnectW InternetCloseHandle

gdiplus

GdipGetImageGraphicsContext GdipCreateBitmapFromResource GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipCloneFont GdipCreateFromHWND GdipGetImageHeight GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipFillRectangleI GdipGetStringFormatTrimming GdipGetStringFormatLineAlign GdipSetStringFormatLineAlign GdipGetStringFormatAlign GdipCreateBitmapFromFile GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipGetFontHeight GdipGetFontSize GdipGetFamily GdipGetFamilyName GdipDeleteFontFamily GdipGetDpiY GdipSetTextRenderingHint GdipDeleteGraphics GdipCreateFromHDC GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipGetStringFormatFlags GdipDisposeImageAttributes GdipSetImageAttributesWrapMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDrawImageRectRectI GdiplusStartup GdipGetFontStyle GdipCreateStringFormat GdipSetStringFormatTrimming GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipFree GdipAlloc GdipSetStringFormatAlign

urlmon

CoInternetSetFeatureEnabled

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

wintrust

CryptCATEnumerateMember CryptCATGetAttrInfo WinVerifyTrust CryptCATClose

crypt32

CryptMsgGetParam CertCloseStore CertFindCertificateInStore CryptHashCertificate2 CryptQueryObject CertFreeCertificateContext CryptMsgClose

cabinet

ord22 ord20

??0?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@QEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@IEAA@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QEAA_NXZ ?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QEAAXXZ ?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z ?unlock@singleton_module@serialization@boost@@QEAAXXZ

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

613KB

Virtual Size

613KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

132KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

interpro

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

388KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=13, id=241, version=40116,

count=175, id=243, version=40116,

count=29, id=242, version=40116,

count=3, id=208, version=65501,

count=1, id=209, version=65501,

count=10, id=259, version=26706,

count=139, id=261, version=26706,

count=35, id=260, version=26706,

count=7, id=206, version=65501,

count=49, id=203, version=65501,

count=568, id=1, productName=Unmarked objects,

count=2, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=26, id=261, productName=VS2017 v15.9.1 build 27023, version=27023,

count=1, id=261, productName=VS2015 UPD3 build 24213, version=24213,

count=159, id=261, version=27042,

count=1, id=256, version=27042,

count=1, id=255, version=27042,

count=1, id=151,

count=1, id=258, version=27042,