2026-10-22_860c2f58a7a79b11a34adf6933612a12_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_860c2f58a7a79b11a34adf6933612a12_glassworm_icedid_njrat_vidar
Size 2.6MB
Sample261024-gtspasxv8r
SHA256 2e40467f77ecd6a98e393d35ba2dd9f2c1d7f4349ffa4076bcce6e46a252ce8e
MD5 860c2f58a7a79b11a34adf6933612a12
SHA1 1c2dc706c4098138e125ea1aab0ee299fd7e1b8a
SHA512 9e335884b9099c9177d46b0916609335a388aeb055eec3c54dc10b860467f1c62dc1c9dbd3882a247a9ce57c73f5204560a304e91452120774606fec4fa9148c
SSDEEP 49152:bzfjXJHCjFWD9groCy802tH2i2/9fLNiXicJFFRGNzj3:FiCle8l7wRGpj3
TLSH
T109D5190273F91B9DF2F38B78D576A6128876BC2D9B11D7EE2254400D1E22B908DB5B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_860c2f58a7a79b11a34adf6933612a12_glassworm_icedid_njrat_vidar

File Explorer

2026-10-22_860c2f58a7a79b11a34adf6933612a12_glassworm_icedid_njrat_vidar

.exe 2.6MB

2026-10-22_860c2f58a7a79b11a34adf6933612a12_glassworm_icedid_njrat_vidar

IMPHASH 0f182d1bf02b1f681a7bf7f6dd66dc41
SHA256 2e40467f77ecd6a98e393d35ba2dd9f2c1d7f4349ffa4076bcce6e46a252ce8e
MD5 860c2f58a7a79b11a34adf6933612a12
SHA1 1c2dc706c4098138e125ea1aab0ee299fd7e1b8a
SHA512 9e335884b9099c9177d46b0916609335a388aeb055eec3c54dc10b860467f1c62dc1c9dbd3882a247a9ce57c73f5204560a304e91452120774606fec4fa9148c
SSDEEP 49152:bzfjXJHCjFWD9groCy802tH2i2/9fLNiXicJFFRGNzj3:FiCle8l7wRGpj3
TLSH
T109D5190273F91B9DF2F38B78D576A6128876BC2D9B11D7EE2254400D1E22B908DB5B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

659264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf_64.pdb

kernel32

WaitForMultipleObjects OutputDebugStringA GetModuleHandleA RaiseException GetTickCount64 SetEndOfFile HeapSize GetStringTypeW OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentThreadId GetThreadId GetSystemPowerStatus GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WideCharToMultiByte GetTimeZoneInformation GetFileAttributesExW GetFileSizeEx CreateFileA DeviceIoControl SetFilePointerEx GetEnvironmentVariableA GetTempPathW GetTempPathA SetLastError CreateMutexA WriteConsoleW SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameA FormatMessageA GetModuleHandleExW CreateMutexW ReleaseMutex GetStdHandle GetCommandLineW TerminateProcess GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW AddDllDirectory WriteConsoleInputW GetConsoleCP ReadConsoleW GetConsoleMode CreateDirectoryW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult LocalFree LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary GetLastError FindNextFileA FindFirstFileA FindClose QueryPerformanceFrequency QueryPerformanceCounter AcquireSRWLockShared WTSGetActiveConsoleSessionId SetStdHandle GetFullPathNameW DeleteFileW CopyFileW ReleaseSRWLockShared CloseHandle CreateThread GetCurrentProcess CreateSemaphoreW Sleep CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock DuplicateHandle GetCurrentDirectoryW SetCurrentDirectoryW HeapReAlloc MoveFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW GetModuleFileNameW TlsFree TlsSetValue RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent __C_specific_handler EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA HeapFree HeapAlloc GetCurrentThread MultiByteToWideChar InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue RtlUnwind

powrprof

PowerWriteSettingAttributes PowerRemovePowerSetting PowerWritePossibleFriendlyName SetSuspendState PowerReadPossibleFriendlyName

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsCompareStringOrdinal WindowsCreateStringReference WindowsGetStringRawBuffer WindowsDuplicateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ole32

CoTaskMemFree CoUninitialize PropVariantClear CoIncrementMTAUsage CoDecrementMTAUsage StringFromCLSID CoInitializeEx CoCreateInstance

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme PowerSettingUnregisterNotification PowerSetActiveScheme PowerSettingRegisterNotification

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

advapi32

CloseServiceHandle EventWrite EventUnregister EventRegister StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService ChangeServiceConfig2W SetTokenInformation DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce AddAccessAllowedAce LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

api-ms-win-devices-config-l1-1-1

CM_Get_Device_ID_List_SizeW CM_Get_DevNode_Registry_PropertyW CM_Locate_DevNodeW CM_Get_Device_ID_ListW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

892KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_860c2f58a7a79b11a34adf6933612a12_glassworm_icedid_njrat_vidar

kernel32

powrprof

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

ole32

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-power-base-l1-1-0

advapi32

userenv

api-ms-win-devices-config-l1-1-1

generic