2026-08-02_ff40b2dc29456c556e30ecd36553e803_coinminer_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_ff40b2dc29456c556e30ecd36553e803_coinminer_icedid_njrat
Size 3.8MB
Sample260802-jhvevsfb53
SHA256 921dfb0566006a6a49a60a23e135a1789643ebbe722ecca73e923d71ace5f85b
MD5 ff40b2dc29456c556e30ecd36553e803
SHA1 c319e0a13cb6ecc9e0e132ba44012cdb16d91b9a
SHA512 766afe4f22181de656cded7639e47dff693c4f33ebfa0e2dc6b239becc3bc52ff4c66faeb0812ab5c8be8af4302b0d2a6c17ba5f3e0e78ef0e467a030f29c5dd
SSDEEP 49152:ezpKTqMZAY0cCnd/ZvxfPI7jzb0XXsqTLIycJcjoPDaX254C6G4kNJWfE/RM5Vas:e1KOM27JfPU3bwsqbI4GFtRNJWsGaqCI
TLSH
T1BC061286E6C902B7F153D77088B2219DF3A45F940B39CBA703DA4125AE366FC4D76722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_ff40b2dc29456c556e30ecd36553e803_coinminer_icedid_njrat

File Explorer

2026-08-02_ff40b2dc29456c556e30ecd36553e803_coinminer_icedid_njrat

.exe 3.8MB

2026-08-02_ff40b2dc29456c556e30ecd36553e803_coinminer_icedid_njrat

IMPHASH 258fb409b82c1d389d3e7cf462c04173
SHA256 921dfb0566006a6a49a60a23e135a1789643ebbe722ecca73e923d71ace5f85b
MD5 ff40b2dc29456c556e30ecd36553e803
SHA1 c319e0a13cb6ecc9e0e132ba44012cdb16d91b9a
SHA512 766afe4f22181de656cded7639e47dff693c4f33ebfa0e2dc6b239becc3bc52ff4c66faeb0812ab5c8be8af4302b0d2a6c17ba5f3e0e78ef0e467a030f29c5dd
SSDEEP 49152:ezpKTqMZAY0cCnd/ZvxfPI7jzb0XXsqTLIycJcjoPDaX254C6G4kNJWfE/RM5Vas:e1KOM27JfPU3bwsqbI4GFtRNJWsGaqCI
TLSH
T1BC061286E6C902B7F153D77088B2219DF3A45F940B39CBA703DA4125AE366FC4D76722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3932098

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetExitCodeProcess SetConsoleCtrlHandler MoveFileA WriteProcessMemory WaitForMultipleObjects GetModuleHandleA OpenProcess MoveFileExA WritePrivateProfileStringA SetFileAttributesA VirtualAllocEx DeleteCriticalSection ExitProcess SetThreadExecutionState CreateRemoteThread CreateProcessA VirtualFreeEx GetPrivateProfileIntA GetPrivateProfileStringA IsWow64Process WriteConsoleW SetEndOfFile HeapSize CreateFileW Process32Next GetFileAttributesA CreateToolhelp32Snapshot InitializeCriticalSection LeaveCriticalSection TerminateProcess EnterCriticalSection Process32First CreateEventA CreateThread SetEvent Sleep WaitForSingleObject CreateDirectoryA GetCurrentProcessId LocalFree CloseHandle DeleteFileA CreateFileA GetLastError CopyFileA ProcessIdToSessionId MultiByteToWideChar GetEnvironmentVariableA GetCurrentProcess GetModuleFileNameA IsBadReadPtr FreeLibrary GetProcessHeap GetProcAddress HeapAlloc GetNativeSystemInfo LoadLibraryA VirtualAlloc VirtualFree SetLastError HeapFree WTSGetActiveConsoleSessionId VirtualProtect SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW RtlUnwind GetFileSizeEx HeapReAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA GetModuleFileNameW WriteFile InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetCurrentThreadId WideCharToMultiByte WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ReadFile ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle

user32

MessageBoxA CharLowerA

advapi32

AdjustTokenPrivileges CryptAcquireContextA RegCloseKey ConvertSidToStringSidA RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA CreateProcessWithTokenW CryptCreateHash CryptHashData RegSetValueExA CryptDestroyHash RegOpenKeyExA CryptGetHashParam CryptReleaseContext CreateProcessAsUserA SetTokenInformation DuplicateTokenEx CreateServiceA StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle QueryServiceConfigA SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA DeleteService ControlService StartServiceA ChangeServiceConfig2A QueryServiceStatusEx OpenServiceA EqualSid AllocateAndInitializeSid GetUserNameA ConvertStringSidToSidW OpenProcessToken FreeSid CheckTokenMembership GetTokenInformation

shell32

ShellExecuteA ShellExecuteExA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathFileExistsA

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsA

ws2_32

socket connect WSAGetLastError inet_ntop setsockopt freeaddrinfo htons send inet_addr WSAStartup getaddrinfo inet_pton closesocket WSACleanup recv

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_ff40b2dc29456c556e30ecd36553e803_coinminer_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

shlwapi

wtsapi32

ws2_32

iphlpapi

msvcrt

psapi

generic