2026-07-17_da6312cc3e4d5d102f3edb5cd6b3338e_coinminer_icedid_njrat_vidar

General

Target
2026-07-17_da6312cc3e4d5d102f3edb5cd6b3338e_coinminer_icedid_njrat_vidar
Size 3.6MB
Sample260718-b86a2sct7p
SHA256 be25527f7ceeb7e66761f76537a1e1f085e45cce6904a552650357f102f3304f
MD5 da6312cc3e4d5d102f3edb5cd6b3338e
SHA1 a27b922f41c43fd851c7e7bc32687b51c13ceb32
SHA512 50ad5ab2c41b2559b081d2b5d8d107a70bfcc61332248809b35263f945c99b816db749c869a4d1cee36a5463a23e436cadd89a059ca32fa73c9f70281a06ec58
SSDEEP 24576:frJl1JwH+1Xn7066DkiQV37aV/zqTeI7RNGa5WXNx1fkq8q2mtP/fogfZFQ2I:frPRg66GmxqTeI7RJ2NrfEzYPno0Zi2
TLSH
T133069D4EEA811DE1D19E8B35891B0D0DE2E2F4910B3657BF27294982DE933E31DB9335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_da6312cc3e4d5d102f3edb5cd6b3338e_coinminer_icedid_njrat_vidar

File Explorer

2026-07-17_da6312cc3e4d5d102f3edb5cd6b3338e_coinminer_icedid_njrat_vidar

.exe 3.6MB

2026-07-17_da6312cc3e4d5d102f3edb5cd6b3338e_coinminer_icedid_njrat_vidar

IMPHASH 29bc7f62b57626997c42d4e6ed35af7a
SHA256 be25527f7ceeb7e66761f76537a1e1f085e45cce6904a552650357f102f3304f
MD5 da6312cc3e4d5d102f3edb5cd6b3338e
SHA1 a27b922f41c43fd851c7e7bc32687b51c13ceb32
SHA512 50ad5ab2c41b2559b081d2b5d8d107a70bfcc61332248809b35263f945c99b816db749c869a4d1cee36a5463a23e436cadd89a059ca32fa73c9f70281a06ec58
SSDEEP 24576:frJl1JwH+1Xn7066DkiQV37aV/zqTeI7RNGa5WXNx1fkq8q2mtP/fogfZFQ2I:frPRg66GmxqTeI7RJ2NrfEzYPno0Zi2
TLSH
T133069D4EEA811DE1D19E8B35891B0D0DE2E2F4910B3657BF27294982DE933E31DB9335
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12697600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\winx64-packages\build\storage\maria\RelWithDebInfo\aria_ftdump.pdb

kernel32

TlsGetValue TlsSetValue TlsFree GetLocaleInfoA GetLastError GetFileAttributesA GetLogicalDrives InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetModuleHandleA GetProcAddress GetFullPathNameA CreateFileA DeleteFileA CloseHandle MoveFileA GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency MapViewOfFile UnmapViewOfFile Sleep InitOnceExecuteOnce WaitForSingleObject OpenThread GetExitCodeThread LockFileEx UnlockFileEx SetLastError GetModuleFileNameA GetStdHandle FlushFileBuffers GetFileAttributesExA ReadFile SetFilePointerEx WriteFile GetCurrentProcess GetTempPathA GetTempFileNameA FindClose FindNextFileA HeapSize GetCurrentThreadId LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection TlsAlloc CreateFileMappingA WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RaiseException InitializeCriticalSectionAndSpinCount FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW SetConsoleCtrlHandler GetTimeZoneInformation WideCharToMultiByte SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetFileType CreateFileW GetDriveTypeW PeekNamedPipe MultiByteToWideChar GetCommandLineA GetCommandLineW GetACP GetFullPathNameW SetEnvironmentVariableA SetEnvironmentVariableW GetCurrentDirectoryW CompareStringW LCMapStringW HeapAlloc HeapFree GetConsoleCP GetConsoleMode GetStringTypeW GetCPInfo HeapReAlloc RtlUnwind

advapi32

RegOpenKeyExA RegEnumValueA RegCloseKey

ws2_32

WSACleanup WSAStartup

Name

.text

Size

501KB

Virtual Size

501KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

10.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_da6312cc3e4d5d102f3edb5cd6b3338e_coinminer_icedid_njrat_vidar

kernel32

advapi32

ws2_32

generic