2026-09-03_fd9ecf2bc8e928e2846f32e38cb4309d_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_fd9ecf2bc8e928e2846f32e38cb4309d_coinminer_icedid_njrat_vidar
Size 1.3MB
Sample260903-wgen8sseqh
SHA256 02840efc5c84c9b4642f112a86fcb791d235028b8c3dfa85de0fdd84539ef4da
MD5 fd9ecf2bc8e928e2846f32e38cb4309d
SHA1 4b1aed86b7cfa395b36d68a940f15b0e4f929118
SHA512 1019bddfd3455122d46dba934e5e7e044c9f18169db41b5703211764da0d06f2a9cfaa621c5d9dc8315535faeca11f6f28456e426f6421a93859d5f94fc75ee0
SSDEEP 24576:1Xzg46XJxgAvOyCOqhRxnsqjnhMgeiCl7G0nehbGZpbD:9U2COyVqx7Dmg27RnWGj
TLSH
T1F255CFC6239704A5E4E741358462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-03_fd9ecf2bc8e928e2846f32e38cb4309d_coinminer_icedid_njrat_vidar

File Explorer

2026-09-03_fd9ecf2bc8e928e2846f32e38cb4309d_coinminer_icedid_njrat_vidar

.exe 1.3MB

2026-09-03_fd9ecf2bc8e928e2846f32e38cb4309d_coinminer_icedid_njrat_vidar

IMPHASH fd5c7ab6be35a0bbed6ae02351521860
SHA256 02840efc5c84c9b4642f112a86fcb791d235028b8c3dfa85de0fdd84539ef4da
MD5 fd9ecf2bc8e928e2846f32e38cb4309d
SHA1 4b1aed86b7cfa395b36d68a940f15b0e4f929118
SHA512 1019bddfd3455122d46dba934e5e7e044c9f18169db41b5703211764da0d06f2a9cfaa621c5d9dc8315535faeca11f6f28456e426f6421a93859d5f94fc75ee0
SSDEEP 24576:1Xzg46XJxgAvOyCOqhRxnsqjnhMgeiCl7G0nehbGZpbD:9U2COyVqx7Dmg27RnWGj
TLSH
T1F255CFC6239704A5E4E741358462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\new\AsusUpdateCheck\x64\Release\AsusUpdateCheck.pdb

kernel32

CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW WTSGetActiveConsoleSessionId CreateProcessW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateDirectoryW FindFirstFileExW FindFirstFileExA RemoveDirectoryW FindNextFileA GetFileAttributesW GetFileAttributesA GetLogicalProcessorInformation GetProcAddress GetModuleHandleW GetSystemFirmwareTable InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException FindResourceExW DecodePointer HeapDestroy GetStdHandle LoadLibraryW FreeLibrary GetSystemDirectoryW GetCurrentProcessId SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP FindResourceW ReadConsoleW SetFilePointerEx GetFileAttributesExW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID LoadResource LockResource FreeResource OpenProcess QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW Sleep WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree FlushFileBuffers WideCharToMultiByte GetWindowsDirectoryW DeleteFileA lstrcatW OutputDebugStringW FormatMessageW LocalAlloc OutputDebugStringA lstrcpynW GetCommandLineW LocalFree CreateEventW WaitForSingleObject SetEvent MoveFileW lstrcmpW lstrcpyW GetFileSize CloseHandle CreateFileA GetLastError CreateFileW FindClose SetFilePointer WriteFile IsValidLocale GetFileType GetCommandLineA RtlUnwind GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx TerminateProcess MapViewOfFile CreateFileMappingW MultiByteToWideChar UnmapViewOfFile GetFileSizeEx GetCurrentProcess SizeofResource LoadLibraryExW GetThreadTimes GetStartupInfoW UnhandledExceptionFilter RtlCaptureContext LCMapStringW CompareStringW GetModuleFileNameW lstrlenW FindNextFileW FindFirstFileW IsValidCodePage ReadFile

user32

FindWindowExW IsWindowVisible GetWindow SendMessageW GetWindowThreadProcessId TranslateMessage DispatchMessageW GetMessageW

advapi32

RegGetValueW RegCloseKey OpenServiceW CryptAcquireContextA CryptDeriveKey CryptReleaseContext RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CreateProcessAsUserW DuplicateTokenEx CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash FreeSid DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService

shell32

ShellExecuteExW Shell_NotifyIconW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData

ws2_32

WSACleanup accept WSAStartup bind listen getaddrinfo freeaddrinfo WSAGetLastError closesocket setsockopt send socket recv

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx

netapi32

NetApiBufferFree NetUserGetInfo

userenv

GetAllUsersProfileDirectoryW CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

SwitchToThread TlsSetValue TlsGetValue TlsAlloc TlsFree GetCurrentThread

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetCPInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_fd9ecf2bc8e928e2846f32e38cb4309d_coinminer_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

winhttp

ws2_32

crypt32

netapi32

userenv

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

generic