2026-09-03_fcf012f788e553d336c45fc6c76b6253_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_fcf012f788e553d336c45fc6c76b6253_coinminer_icedid_njrat_vidar
Size 1.3MB
Sample260903-wjpbfssfmd
SHA256 f7456878382d2e34c8b3e2729c00883ea96aa0dc04bd6a2bb2d51743f7988f91
MD5 fcf012f788e553d336c45fc6c76b6253
SHA1 27591df47fdb5829ea6ad5d6affdf0c6173672bc
SHA512 778fbd9bc5a5c76f19be6af698f24c7991b6f80268480b0c2cff9ebb40d9f84e91b9a9686eef25c3c54d0231a9c13d0928df7df187097a7d98f02855197bfb6f
SSDEEP 24576:8Xzg46XJxgAvOyCOqhRxIsqjnhMgeiCl7G0nehbGZpbD:0U2COyVqx0Dmg27RnWGj
TLSH
T14455CFC6239704A5E5E741348462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-03_fcf012f788e553d336c45fc6c76b6253_coinminer_icedid_njrat_vidar

File Explorer

2026-09-03_fcf012f788e553d336c45fc6c76b6253_coinminer_icedid_njrat_vidar

.exe 1.3MB

2026-09-03_fcf012f788e553d336c45fc6c76b6253_coinminer_icedid_njrat_vidar

IMPHASH fd5c7ab6be35a0bbed6ae02351521860
SHA256 f7456878382d2e34c8b3e2729c00883ea96aa0dc04bd6a2bb2d51743f7988f91
MD5 fcf012f788e553d336c45fc6c76b6253
SHA1 27591df47fdb5829ea6ad5d6affdf0c6173672bc
SHA512 778fbd9bc5a5c76f19be6af698f24c7991b6f80268480b0c2cff9ebb40d9f84e91b9a9686eef25c3c54d0231a9c13d0928df7df187097a7d98f02855197bfb6f
SSDEEP 24576:8Xzg46XJxgAvOyCOqhRxIsqjnhMgeiCl7G0nehbGZpbD:0U2COyVqx0Dmg27RnWGj
TLSH
T14455CFC6239704A5E5E741348462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\new\AsusUpdateCheck\x64\Release\AsusUpdateCheck.pdb

kernel32

CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW WTSGetActiveConsoleSessionId CreateProcessW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateDirectoryW FindFirstFileExW FindFirstFileExA RemoveDirectoryW FindNextFileA GetFileAttributesW GetFileAttributesA GetLogicalProcessorInformation GetProcAddress GetModuleHandleW GetSystemFirmwareTable InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException FindResourceExW DecodePointer HeapDestroy GetStdHandle LoadLibraryW FreeLibrary GetSystemDirectoryW GetCurrentProcessId SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP FindResourceW ReadConsoleW SetFilePointerEx GetFileAttributesExW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID LoadResource LockResource FreeResource OpenProcess QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW Sleep WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree FlushFileBuffers WideCharToMultiByte GetWindowsDirectoryW DeleteFileA lstrcatW OutputDebugStringW FormatMessageW LocalAlloc OutputDebugStringA lstrcpynW GetCommandLineW LocalFree CreateEventW WaitForSingleObject SetEvent MoveFileW lstrcmpW lstrcpyW GetFileSize CloseHandle CreateFileA GetLastError CreateFileW FindClose SetFilePointer WriteFile IsValidLocale GetFileType GetCommandLineA RtlUnwind GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx TerminateProcess MapViewOfFile CreateFileMappingW MultiByteToWideChar UnmapViewOfFile GetFileSizeEx GetCurrentProcess SizeofResource LoadLibraryExW GetThreadTimes GetStartupInfoW UnhandledExceptionFilter RtlCaptureContext LCMapStringW CompareStringW GetModuleFileNameW lstrlenW FindNextFileW FindFirstFileW IsValidCodePage ReadFile

user32

FindWindowExW IsWindowVisible GetWindow SendMessageW GetWindowThreadProcessId TranslateMessage DispatchMessageW GetMessageW

advapi32

RegGetValueW RegCloseKey OpenServiceW CryptAcquireContextA CryptDeriveKey CryptReleaseContext RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CreateProcessAsUserW DuplicateTokenEx CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash FreeSid DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService

shell32

ShellExecuteExW Shell_NotifyIconW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData

ws2_32

WSACleanup accept WSAStartup bind listen getaddrinfo freeaddrinfo WSAGetLastError closesocket setsockopt send socket recv

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx

netapi32

NetApiBufferFree NetUserGetInfo

userenv

GetAllUsersProfileDirectoryW CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

SwitchToThread TlsSetValue TlsGetValue TlsAlloc TlsFree GetCurrentThread

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetCPInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_fcf012f788e553d336c45fc6c76b6253_coinminer_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

winhttp

ws2_32

crypt32

netapi32

userenv

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

generic