2026-08-04_4f8a34c0a293d5f4a02e8234a3c19a6f_coinminer_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_4f8a34c0a293d5f4a02e8234a3c19a6f_coinminer_icedid_njrat_ryuk
Size 2.1MB
Sample260805-bbkyvasvft
SHA256 d4a9edcd0da706d7894da5f65427008a1a07e428b009372574fa307a3a1c2139
MD5 4f8a34c0a293d5f4a02e8234a3c19a6f
SHA1 2e73e877ad515f6c09836801d9f76e57cced161c
SHA512 dbb7ca9a1b77ef4dc5de9fc57ab41432caea4d649bb14a73423de4d4d76c1344c7f3b3a0da26a11b3f500fcd60882f3de6b3e6741a81114d7eb8e8a3e05326f3
SSDEEP 49152:/ewnQ3gGGRWP8ZTi313tHCfrojXujr0s:fmzuoajr0s
TLSH
T121A58D01B2F555ECD0B791388566B50BEA72780907305AEB23949BBD2F63EC14EF7362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_4f8a34c0a293d5f4a02e8234a3c19a6f_coinminer_icedid_njrat_ryuk

.exe 2.1MB

2026-08-04_4f8a34c0a293d5f4a02e8234a3c19a6f_coinminer_icedid_njrat_ryuk

IMPHASH 96dec791b94a24796f0ea78760a20528
SHA256 d4a9edcd0da706d7894da5f65427008a1a07e428b009372574fa307a3a1c2139
MD5 4f8a34c0a293d5f4a02e8234a3c19a6f
SHA1 2e73e877ad515f6c09836801d9f76e57cced161c
SHA512 dbb7ca9a1b77ef4dc5de9fc57ab41432caea4d649bb14a73423de4d4d76c1344c7f3b3a0da26a11b3f500fcd60882f3de6b3e6741a81114d7eb8e8a3e05326f3
SSDEEP 49152:/ewnQ3gGGRWP8ZTi313tHCfrojXujr0s:fmzuoajr0s
TLSH
T121A58D01B2F555ECD0B791388566B50BEA72780907305AEB23949BBD2F63EC14EF7362
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

ef:8c:ef:cb:89:24:cb:9b:b6:f5:0c:93:9b:76:05:26:8a:59:b9:62:46:77:44:1f:00:c5:47:76:9f:fd:eb:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=株式会社アドバンスト・メディア,O=株式会社アドバンスト・メディア,L=豊島区,ST=東京都,C=JP

Chains

May 29, 2026

CN=株式会社アドバンスト・メディア,O=株式会社アドバンスト・メディア,L=豊島区,ST=東京都,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=株式会社アドバンスト・メディア,O=株式会社アドバンスト・メディア,L=豊島区,ST=東京都,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=株式会社アドバンスト・メディア,O=株式会社アドバンスト・メディア,L=豊島区,ST=東京都,C=JP

Serial Number

01:69:eb:97:f7:a5:6a:de:a5:b7:cb:df:ae:f7:ab:f6

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 5, 2023 - Sep 19, 2026

Minor OS version

Major OS version

Entry point

1226552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msacm32

acmStreamConvert acmStreamUnprepareHeader acmStreamPrepareHeader acmStreamClose acmStreamSize acmFormatTagDetailsW acmStreamOpen acmFormatSuggest

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

mf

MFCreateTopologyNode MFCreateTopology MFCreateMediaSession

mfplat

MFPutWorkItem MFCreateWaveFormatExFromMFMediaType MFCreateEventQueue MFAllocateWorkQueue MFCreateMediaType MFUnlockWorkQueue MFInvokeCallback MFCreateAsyncResult MFStartup MFCreateSourceResolver MFShutdown

kernel32

SetEndOfFile HeapFree GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleHandleExW ExitProcess WriteConsoleW SetStdHandle CreateFileW GetACP ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError MultiByteToWideChar FreeLibrary LoadLibraryW GetProcAddress WideCharToMultiByte Sleep GetLastError GetTickCount InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection AllocConsole GetLocalTime FreeConsole GetModuleFileNameW InitializeCriticalSectionEx RaiseException CreateEventW CloseHandle SetEvent WaitForSingleObject ResetEvent GetFileType GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose HeapSize HeapReAlloc GetOEMCP IsValidCodePage GetCPInfo FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetStringTypeW IsDebuggerPresent OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RtlUnwindEx HeapAlloc

user32

wsprintfW

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoCreateInstance PropVariantCopy PropVariantClear CoInitialize

wininet

InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpQueryInfoW InternetReadFile InternetCloseHandle HttpSendRequestW

ws2_32

getaddrinfo WSAGetLastError socket ioctlsocket connect closesocket freeaddrinfo select __WSAFDIsSet shutdown send recv htons recvfrom WSAStartup bind

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

56KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_4f8a34c0a293d5f4a02e8234a3c19a6f_coinminer_icedid_njrat_ryuk

msacm32

version

mf

mfplat

kernel32

user32

ole32

wininet

ws2_32

generic