2026-08-04_54b8da47b2b001b843e23063d158d921_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_54b8da47b2b001b843e23063d158d921_coinminer_icedid_njrat_vidar
Size 1.6MB
Sample260804-s7aleshp41
SHA256 a3c8a17fba640f9e519dad35bf33711d0ec697f812bce021cc28e06097e83fef
MD5 54b8da47b2b001b843e23063d158d921
SHA1 9cc02fa7f9fb6bdf0fe3e4df591b6e9c98d26cdb
SHA512 72daebe0ed7211ecbc904ca86dfcfacd6220ccde2bf20dfd82426580664351f9dc17cddc6c5ae51ba419dfa976c947e99c4410b0f538adcc35678647a6e190f1
SSDEEP 24576:ONvC2AJ+N/8F8vi7BuQyHAI1EWAQ4RL/Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLB:ONvCfz8K7BuQygD/m+brLC2hTR9quLB
TLSH
T14375E0C5E3A704E5E1E782354462913DF2337C7A77E1C79B129B61672E722908E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_54b8da47b2b001b843e23063d158d921_coinminer_icedid_njrat_vidar

File Explorer

2026-08-04_54b8da47b2b001b843e23063d158d921_coinminer_icedid_njrat_vidar

.exe 1.6MB

2026-08-04_54b8da47b2b001b843e23063d158d921_coinminer_icedid_njrat_vidar

IMPHASH ca1779863fa32a13bf1d3b0f0786e1f9
SHA256 a3c8a17fba640f9e519dad35bf33711d0ec697f812bce021cc28e06097e83fef
MD5 54b8da47b2b001b843e23063d158d921
SHA1 9cc02fa7f9fb6bdf0fe3e4df591b6e9c98d26cdb
SHA512 72daebe0ed7211ecbc904ca86dfcfacd6220ccde2bf20dfd82426580664351f9dc17cddc6c5ae51ba419dfa976c947e99c4410b0f538adcc35678647a6e190f1
SSDEEP 24576:ONvC2AJ+N/8F8vi7BuQyHAI1EWAQ4RL/Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLB:ONvCfz8K7BuQygD/m+brLC2hTR9quLB
TLSH
T14375E0C5E3A704E5E1E782354462913DF2337C7A77E1C79B129B61672E722908E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\AsusUpdateCheck\x64\Release\AsusUpdateCheck.pdb

kernel32

TerminateProcess OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW WTSGetActiveConsoleSessionId CreateProcessW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateDirectoryW FindFirstFileExW RemoveDirectoryW GetFileAttributesW GetLogicalProcessorInformation GetProcAddress GetModuleHandleW GetSystemFirmwareTable InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException FindResourceExW DecodePointer HeapDestroy GetStdHandle LoadLibraryW FreeLibrary GetSystemDirectoryW GetCurrentProcessId SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW LoadResource GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetFileAttributesExW ReadConsoleW LockResource FreeResource SizeofResource GetProcessHeap HeapAlloc MapViewOfFile QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW Sleep WaitForMultipleObjects FlushFileBuffers WideCharToMultiByte GetWindowsDirectoryW lstrcatW OutputDebugStringW FormatMessageW LocalAlloc OutputDebugStringA GetCommandLineW LocalFree GetLastError CreateEventW WaitForSingleObject SetEvent ReadFile MoveFileW lstrcmpW lstrcpyW GetFileSize CloseHandle CreateFileW FindClose SetFilePointer lstrcpynW SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetCommandLineA GetModuleHandleExW ExitProcess LoadLibraryExW CreateFileMappingW MultiByteToWideChar UnmapViewOfFile GetFileSizeEx GetCurrentProcess GetModuleFileNameW HeapFree RtlPcToFileHeader RtlUnwindEx InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError GetCPInfo EncodePointer FindResourceW WriteFile lstrlenW FindNextFileW FindFirstFileW FreeEnvironmentStringsW RtlUnwind

user32

SendMessageW TranslateMessage GetMessageW DispatchMessageW GetWindowThreadProcessId GetWindow FindWindowExW IsWindowVisible

advapi32

CryptAcquireContextW RegGetValueW RegCloseKey OpenServiceW CryptAcquireContextA CryptDeriveKey CryptReleaseContext RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CreateProcessAsUserW DuplicateTokenEx CryptDestroyKey CryptDecrypt CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService FreeSid

shell32

Shell_NotifyIconW ShellExecuteExW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersInfo

setupapi

SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

ws2_32

setsockopt recv socket WSAGetLastError freeaddrinfo getaddrinfo listen bind accept send WSACleanup WSAStartup closesocket

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx

netapi32

NetUserGetInfo NetApiBufferFree

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW GetAllUsersProfileDirectoryW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

Name

.text

Size

253KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

648KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_54b8da47b2b001b843e23063d158d921_coinminer_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

winhttp

ws2_32

crypt32

netapi32

userenv

wtsapi32

generic