2026-09-03_a8b7e03ed8a2caed6c5b3ab4ffa9652a_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_a8b7e03ed8a2caed6c5b3ab4ffa9652a_coinminer_icedid_njrat_vidar
Size 1.3MB
Sample260905-17tnastdpc
SHA256 ac9278d9c219770a12d413fe51b4a8f20f28e98e821259e59fe6011c0faae131
MD5 a8b7e03ed8a2caed6c5b3ab4ffa9652a
SHA1 ede1b03318879d8041b89383fd737469214f59a4
SHA512 db9a5ab452942b6740fd57980afbc8797b0e0693aa0805a32ede31b58253486ffc80a4b16df7992aa3952b85497184749059a863b0dc06a367f68eec52ee62c2
SSDEEP 24576:AXzg46XJxgAvOyCOqhRxCsqjnhMgeiCl7G0nehbGZpbD:gU2COyVqxGDmg27RnWGj
TLSH
T19C55CFC6239704A5E5E741348462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-03_a8b7e03ed8a2caed6c5b3ab4ffa9652a_coinminer_icedid_njrat_vidar

File Explorer

2026-09-03_a8b7e03ed8a2caed6c5b3ab4ffa9652a_coinminer_icedid_njrat_vidar

.exe 1.3MB

2026-09-03_a8b7e03ed8a2caed6c5b3ab4ffa9652a_coinminer_icedid_njrat_vidar

IMPHASH fd5c7ab6be35a0bbed6ae02351521860
SHA256 ac9278d9c219770a12d413fe51b4a8f20f28e98e821259e59fe6011c0faae131
MD5 a8b7e03ed8a2caed6c5b3ab4ffa9652a
SHA1 ede1b03318879d8041b89383fd737469214f59a4
SHA512 db9a5ab452942b6740fd57980afbc8797b0e0693aa0805a32ede31b58253486ffc80a4b16df7992aa3952b85497184749059a863b0dc06a367f68eec52ee62c2
SSDEEP 24576:AXzg46XJxgAvOyCOqhRxCsqjnhMgeiCl7G0nehbGZpbD:gU2COyVqxGDmg27RnWGj
TLSH
T19C55CFC6239704A5E5E741348462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\new\AsusUpdateCheck\x64\Release\AsusUpdateCheck.pdb

kernel32

CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW WTSGetActiveConsoleSessionId CreateProcessW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateDirectoryW FindFirstFileExW FindFirstFileExA RemoveDirectoryW FindNextFileA GetFileAttributesW GetFileAttributesA GetLogicalProcessorInformation GetProcAddress GetModuleHandleW GetSystemFirmwareTable InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException FindResourceExW DecodePointer HeapDestroy GetStdHandle LoadLibraryW FreeLibrary GetSystemDirectoryW GetCurrentProcessId SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP FindResourceW ReadConsoleW SetFilePointerEx GetFileAttributesExW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID LoadResource LockResource FreeResource OpenProcess QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW Sleep WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree FlushFileBuffers WideCharToMultiByte GetWindowsDirectoryW DeleteFileA lstrcatW OutputDebugStringW FormatMessageW LocalAlloc OutputDebugStringA lstrcpynW GetCommandLineW LocalFree CreateEventW WaitForSingleObject SetEvent MoveFileW lstrcmpW lstrcpyW GetFileSize CloseHandle CreateFileA GetLastError CreateFileW FindClose SetFilePointer WriteFile IsValidLocale GetFileType GetCommandLineA RtlUnwind GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx TerminateProcess MapViewOfFile CreateFileMappingW MultiByteToWideChar UnmapViewOfFile GetFileSizeEx GetCurrentProcess SizeofResource LoadLibraryExW GetThreadTimes GetStartupInfoW UnhandledExceptionFilter RtlCaptureContext LCMapStringW CompareStringW GetModuleFileNameW lstrlenW FindNextFileW FindFirstFileW IsValidCodePage ReadFile

user32

FindWindowExW IsWindowVisible GetWindow SendMessageW GetWindowThreadProcessId TranslateMessage DispatchMessageW GetMessageW

advapi32

RegGetValueW RegCloseKey OpenServiceW CryptAcquireContextA CryptDeriveKey CryptReleaseContext RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CreateProcessAsUserW DuplicateTokenEx CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash FreeSid DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService

shell32

ShellExecuteExW Shell_NotifyIconW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData

ws2_32

WSACleanup accept WSAStartup bind listen getaddrinfo freeaddrinfo WSAGetLastError closesocket setsockopt send socket recv

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx

netapi32

NetApiBufferFree NetUserGetInfo

userenv

GetAllUsersProfileDirectoryW CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

SwitchToThread TlsSetValue TlsGetValue TlsAlloc TlsFree GetCurrentThread

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetCPInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_a8b7e03ed8a2caed6c5b3ab4ffa9652a_coinminer_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

winhttp

ws2_32

crypt32

netapi32

userenv

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

generic