2026-08-09_e9212b9e79504e628d6df0d6c25b1115_coinminer_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_e9212b9e79504e628d6df0d6c25b1115_coinminer_icedid_luca-stealer_njrat
Size 1.3MB
Sample260809-fejbmstxhy
SHA256 30ccb7f60f1896e41d50412a20befa2c86c5f768f0ccfc5e979049e2beb307fe
MD5 e9212b9e79504e628d6df0d6c25b1115
SHA1 22e30c78fd3344664d27a5d0e1cbb276d524d280
SHA512 6e239f4cb3644ef3ee17e7e78886a70bccc636982edf9893b9b35bfb073dbd0c7b0c2cacd39a07fdabcc957c5fa94e71309d8067c00dfb681fb1e3c6736edb69
SSDEEP 24576:7CV9CTlsA4mmQJ4irGEGiSOU1RXhWiKzxRq+NnT:7pGaGkU1RQi+5T
TLSH
T1F4558E46B2B401FCC1A7C0B485151A0BEBB2784617749BDB55D4CAAE6F23FE11ABE334
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_e9212b9e79504e628d6df0d6c25b1115_coinminer_icedid_luca-stealer_njrat

.exe 1.3MB

2026-08-09_e9212b9e79504e628d6df0d6c25b1115_coinminer_icedid_luca-stealer_njrat

IMPHASH 4e955edb7df1656c297ea9f9d8b60281
SHA256 30ccb7f60f1896e41d50412a20befa2c86c5f768f0ccfc5e979049e2beb307fe
MD5 e9212b9e79504e628d6df0d6c25b1115
SHA1 22e30c78fd3344664d27a5d0e1cbb276d524d280
SHA512 6e239f4cb3644ef3ee17e7e78886a70bccc636982edf9893b9b35bfb073dbd0c7b0c2cacd39a07fdabcc957c5fa94e71309d8067c00dfb681fb1e3c6736edb69
SSDEEP 24576:7CV9CTlsA4mmQJ4irGEGiSOU1RXhWiKzxRq+NnT:7pGaGkU1RQi+5T
TLSH
T1F4558E46B2B401FCC1A7C0B485151A0BEBB2784617749BDB55D4CAAE6F23FE11ABE334
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

ed:27:6e:14:ce:b8:67:72:f6:26:ff:48:9f:7f:67:c6:c1:74:72:fc:19:8b:ff:b0:1d:20:22:ed:ea:d5:9d:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jul 29, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:03:98:72:72:ce:ac:0a:e5:01:c2:ae:00:00:00:03:98:72

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2026 - Jul 31, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

991496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetDriveTypeW FindNextFileW OutputDebugStringW InitializeCriticalSectionAndSpinCount InitializeCriticalSection CreateMutexW ReleaseMutex MultiByteToWideChar WideCharToMultiByte LocalFree GetModuleHandleExW GetModuleFileNameW GetProcAddress GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemTime QueryPerformanceCounter GetTickCount TerminateProcess GetTempPathW InitializeCriticalSectionEx GetSystemDirectoryW GetWindowsDirectoryW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA UnlockFileEx GetCurrentThreadId HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA FindClose RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime FormatMessageA WriteConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileW CreateDirectoryW Sleep FlushFileBuffers MapViewOfFile CreateFileMappingW GetFileSize SetFileAttributesW UnmapViewOfFile GetFileAttributesW CreateFileW SetEndOfFile DeleteFileW SetFilePointer WriteFile ReadFile CloseHandle GetLastError WaitForSingleObject GetCurrentProcess FindFirstFileExW GetTimeZoneInformation LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW SetLastError HeapReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer

user32

MessageBoxW

advapi32

RegCloseKey RegCreateKeyExW RegQueryValueExW

shell32

SHGetMalloc ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_e9212b9e79504e628d6df0d6c25b1115_coinminer_icedid_luca-stealer_njrat

kernel32

user32

advapi32

shell32

ole32

generic