2026-08-08_d3d7bd9540f55d35a89acbddcfa32b9a_coinminer_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_d3d7bd9540f55d35a89acbddcfa32b9a_coinminer_icedid_njrat
Size 2.7MB
Sample260808-mr3pdavfka
SHA256 fe3bcf921a1c9ccf8afdbcbcbc6e51d3232f353df458e2800b2f20dda272f23f
MD5 d3d7bd9540f55d35a89acbddcfa32b9a
SHA1 824465b4e4e70b78126497a68bbe767e93cfafd0
SHA512 f2b0aa4537fa79d32a49ddfa96e019c24a5c25eb78b486eebdf294e1b7850a88ed715d4e233fab964de4cf4cc8162979841c7e98885dfd5a0c13d72e60bb4c62
SSDEEP 49152:TbMfwU3Rv5tYNEfoAaFOnymdqnqohip45QmErHmqu5Dk:nMTBqNCQmkqo4rHmqcg
TLSH
T1EED502C2DAC80677E1A3D77488A21248F3B81F951736D7AB039E01626F326FC9D75762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_d3d7bd9540f55d35a89acbddcfa32b9a_coinminer_icedid_njrat

File Explorer

2026-08-08_d3d7bd9540f55d35a89acbddcfa32b9a_coinminer_icedid_njrat

.exe 2.7MB

2026-08-08_d3d7bd9540f55d35a89acbddcfa32b9a_coinminer_icedid_njrat

IMPHASH 36d96c7e180faee40e481c8437e8ca58
SHA256 fe3bcf921a1c9ccf8afdbcbcbc6e51d3232f353df458e2800b2f20dda272f23f
MD5 d3d7bd9540f55d35a89acbddcfa32b9a
SHA1 824465b4e4e70b78126497a68bbe767e93cfafd0
SHA512 f2b0aa4537fa79d32a49ddfa96e019c24a5c25eb78b486eebdf294e1b7850a88ed715d4e233fab964de4cf4cc8162979841c7e98885dfd5a0c13d72e60bb4c62
SSDEEP 49152:TbMfwU3Rv5tYNEfoAaFOnymdqnqohip45QmErHmqu5Dk:nMTBqNCQmkqo4rHmqcg
TLSH
T1EED502C2DAC80677E1A3D77488A21248F3B81F951736D7AB039E01626F326FC9D75762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2820205

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LeaveCriticalSection InitializeCriticalSection CreateToolhelp32Snapshot GetFileAttributesA Process32Next DeleteCriticalSection GetExitCodeProcess SetConsoleCtrlHandler MoveFileA WriteProcessMemory WaitForMultipleObjects GetModuleHandleA OpenProcess TerminateProcess WritePrivateProfileStringA SetFileAttributesA VirtualAllocEx ExitProcess SetThreadExecutionState CreateRemoteThread CreateProcessA VirtualFreeEx GetPrivateProfileIntA GetPrivateProfileStringA IsWow64Process WriteConsoleW SetEndOfFile HeapSize EnterCriticalSection Process32First CreateEventA CreateThread SetEvent Sleep WaitForSingleObject CreateDirectoryA GetCurrentProcessId LocalFree CloseHandle DeleteFileA CreateFileA GetLastError CopyFileA ProcessIdToSessionId MultiByteToWideChar GetEnvironmentVariableA GetCurrentProcess GetModuleFileNameA IsBadReadPtr FreeLibrary GetProcessHeap GetProcAddress HeapAlloc GetNativeSystemInfo LoadLibraryA VirtualAlloc VirtualFree SetLastError HeapFree MoveFileExA VirtualProtect CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx HeapReAlloc GetFileType RtlUnwind ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ReadFile ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW

user32

CharLowerA

advapi32

AdjustTokenPrivileges RegCloseKey ConvertSidToStringSidA RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA CreateProcessWithTokenW RegSetValueExA RegOpenKeyExA CreateProcessAsUserA SetTokenInformation DuplicateTokenEx CreateServiceA StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle QueryServiceConfigA SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA DeleteService ControlService StartServiceA ChangeServiceConfig2A QueryServiceStatusEx OpenServiceA EqualSid AllocateAndInitializeSid GetUserNameA ConvertStringSidToSidW OpenProcessToken FreeSid CheckTokenMembership GetTokenInformation

shell32

ShellExecuteExA ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathFileExistsA

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsA

ws2_32

connect socket recv inet_addr setsockopt freeaddrinfo htons send WSAStartup getaddrinfo inet_pton closesocket WSACleanup inet_ntop

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_d3d7bd9540f55d35a89acbddcfa32b9a_coinminer_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

shlwapi

wtsapi32

ws2_32

iphlpapi

msvcrt

psapi

generic