2026-09-01_4f07fa82928c4f51b7c3b156c0c460fb_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_4f07fa82928c4f51b7c3b156c0c460fb_coinminer_icedid_njrat_vidar
Size 1.9MB
Sample260903-phl2daswhy
SHA256 965d31c1b6c418dfa51cb6e3077156a1c89a0b2fa7784467e23118094229343c
MD5 4f07fa82928c4f51b7c3b156c0c460fb
SHA1 cef0aea126f80ce765bbed05def9326f5442f2f9
SHA512 c03a8ba69891dd0ba8fba87cbdccc8e645b94262e8de8702fc078245d2f987c97b8735e4022bab11a0519ebb2f712e1b463086ffc72e1ff6f441ce7e5c0df634
SSDEEP 24576:SXzg46X4xgAvOyCOqhRxqsqjnhMgeiCl7G0nehbGZpbD3sqjnhMgeiCl7G0nehbo:CU/COyVqx+Dmg27RnWGjTDmg27RnWGj
TLSH
T1C195E0D6239700A5E4E741348462953DF2337C3677E1C7DB169FA16B7E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_4f07fa82928c4f51b7c3b156c0c460fb_coinminer_icedid_njrat_vidar

File Explorer

2026-09-01_4f07fa82928c4f51b7c3b156c0c460fb_coinminer_icedid_njrat_vidar

.exe 1.9MB

2026-09-01_4f07fa82928c4f51b7c3b156c0c460fb_coinminer_icedid_njrat_vidar

IMPHASH fd5c7ab6be35a0bbed6ae02351521860
SHA256 965d31c1b6c418dfa51cb6e3077156a1c89a0b2fa7784467e23118094229343c
MD5 4f07fa82928c4f51b7c3b156c0c460fb
SHA1 cef0aea126f80ce765bbed05def9326f5442f2f9
SHA512 c03a8ba69891dd0ba8fba87cbdccc8e645b94262e8de8702fc078245d2f987c97b8735e4022bab11a0519ebb2f712e1b463086ffc72e1ff6f441ce7e5c0df634
SSDEEP 24576:SXzg46X4xgAvOyCOqhRxqsqjnhMgeiCl7G0nehbGZpbD3sqjnhMgeiCl7G0nehbo:CU/COyVqx+Dmg27RnWGjTDmg27RnWGj
TLSH
T1C195E0D6239700A5E4E741348462953DF2337C3677E1C7DB169FA16B7E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\new\AsusUpdateCheck\x64\Release\AsusUpdateCheck.pdb

kernel32

CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW WTSGetActiveConsoleSessionId CreateProcessW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateDirectoryW FindFirstFileExW FindFirstFileExA RemoveDirectoryW FindNextFileA GetFileAttributesW GetFileAttributesA GetLogicalProcessorInformation GetProcAddress GetModuleHandleW GetSystemFirmwareTable InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException FindResourceExW DecodePointer HeapDestroy GetStdHandle LoadLibraryW FreeLibrary GetSystemDirectoryW GetCurrentProcessId SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP FindResourceW ReadConsoleW SetFilePointerEx GetFileAttributesExW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID LoadResource LockResource FreeResource OpenProcess QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW Sleep WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree FlushFileBuffers WideCharToMultiByte GetWindowsDirectoryW DeleteFileA lstrcatW OutputDebugStringW FormatMessageW LocalAlloc OutputDebugStringA lstrcpynW GetCommandLineW LocalFree CreateEventW WaitForSingleObject SetEvent MoveFileW lstrcmpW lstrcpyW GetFileSize CloseHandle CreateFileA GetLastError CreateFileW FindClose SetFilePointer WriteFile IsValidLocale GetFileType GetCommandLineA RtlUnwind GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx TerminateProcess MapViewOfFile CreateFileMappingW MultiByteToWideChar UnmapViewOfFile GetFileSizeEx GetCurrentProcess SizeofResource LoadLibraryExW GetThreadTimes GetStartupInfoW UnhandledExceptionFilter RtlCaptureContext LCMapStringW CompareStringW GetModuleFileNameW lstrlenW FindNextFileW FindFirstFileW IsValidCodePage ReadFile

user32

FindWindowExW IsWindowVisible GetWindow SendMessageW GetWindowThreadProcessId TranslateMessage DispatchMessageW GetMessageW

advapi32

RegGetValueW RegCloseKey OpenServiceW CryptAcquireContextA CryptDeriveKey CryptReleaseContext RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CreateProcessAsUserW DuplicateTokenEx CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash FreeSid DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService

shell32

ShellExecuteExW Shell_NotifyIconW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData

ws2_32

WSACleanup accept WSAStartup bind listen getaddrinfo freeaddrinfo WSAGetLastError closesocket setsockopt send socket recv

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx

netapi32

NetApiBufferFree NetUserGetInfo

userenv

GetAllUsersProfileDirectoryW CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

SwitchToThread TlsSetValue TlsGetValue TlsAlloc TlsFree GetCurrentThread

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetCPInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_4f07fa82928c4f51b7c3b156c0c460fb_coinminer_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

winhttp

ws2_32

crypt32

netapi32

userenv

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

generic