2026-09-08_b3b257be31ab1eaf4fbd826b4baef377_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_b3b257be31ab1eaf4fbd826b4baef377_coinminer_icedid_njrat_vidar
Size 1.3MB
Sample260910-dvemaaek5s
SHA256 ac2829e884828f593c253689326ae9943a5c2190663c209fb50b17da0c912d61
MD5 b3b257be31ab1eaf4fbd826b4baef377
SHA1 eeb18f258d2724e2e349c10061899958ceabfd54
SHA512 15d81c599db5710888e33bfeb3016024fc4add7427262eec6c814423e99112179eb9b878bd1b6f68b545f900b264db60f741bc0d0910793dcbcfa00e7aacb76d
SSDEEP 24576:AXzg46XJxgAvOyCOqhRxPsqjnhMgeiCl7G0nehbGZpbD:gU2COyVqxzDmg27RnWGj
TLSH
T15955CFC6239704A5E5E741348462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_b3b257be31ab1eaf4fbd826b4baef377_coinminer_icedid_njrat_vidar

File Explorer

2026-09-08_b3b257be31ab1eaf4fbd826b4baef377_coinminer_icedid_njrat_vidar

.exe 1.3MB

2026-09-08_b3b257be31ab1eaf4fbd826b4baef377_coinminer_icedid_njrat_vidar

IMPHASH fd5c7ab6be35a0bbed6ae02351521860
SHA256 ac2829e884828f593c253689326ae9943a5c2190663c209fb50b17da0c912d61
MD5 b3b257be31ab1eaf4fbd826b4baef377
SHA1 eeb18f258d2724e2e349c10061899958ceabfd54
SHA512 15d81c599db5710888e33bfeb3016024fc4add7427262eec6c814423e99112179eb9b878bd1b6f68b545f900b264db60f741bc0d0910793dcbcfa00e7aacb76d
SSDEEP 24576:AXzg46XJxgAvOyCOqhRxPsqjnhMgeiCl7G0nehbGZpbD:gU2COyVqxzDmg27RnWGj
TLSH
T15955CFC6239704A5E5E741348462953DF2337C3677E1C7DB169FA16B3E722908E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\new\AsusUpdateCheck\x64\Release\AsusUpdateCheck.pdb

kernel32

CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW WTSGetActiveConsoleSessionId CreateProcessW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateDirectoryW FindFirstFileExW FindFirstFileExA RemoveDirectoryW FindNextFileA GetFileAttributesW GetFileAttributesA GetLogicalProcessorInformation GetProcAddress GetModuleHandleW GetSystemFirmwareTable InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException FindResourceExW DecodePointer HeapDestroy GetStdHandle LoadLibraryW FreeLibrary GetSystemDirectoryW GetCurrentProcessId SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP FindResourceW ReadConsoleW SetFilePointerEx GetFileAttributesExW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID LoadResource LockResource FreeResource OpenProcess QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW Sleep WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree FlushFileBuffers WideCharToMultiByte GetWindowsDirectoryW DeleteFileA lstrcatW OutputDebugStringW FormatMessageW LocalAlloc OutputDebugStringA lstrcpynW GetCommandLineW LocalFree CreateEventW WaitForSingleObject SetEvent MoveFileW lstrcmpW lstrcpyW GetFileSize CloseHandle CreateFileA GetLastError CreateFileW FindClose SetFilePointer WriteFile IsValidLocale GetFileType GetCommandLineA RtlUnwind GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx TerminateProcess MapViewOfFile CreateFileMappingW MultiByteToWideChar UnmapViewOfFile GetFileSizeEx GetCurrentProcess SizeofResource LoadLibraryExW GetThreadTimes GetStartupInfoW UnhandledExceptionFilter RtlCaptureContext LCMapStringW CompareStringW GetModuleFileNameW lstrlenW FindNextFileW FindFirstFileW IsValidCodePage ReadFile

user32

FindWindowExW IsWindowVisible GetWindow SendMessageW GetWindowThreadProcessId TranslateMessage DispatchMessageW GetMessageW

advapi32

RegGetValueW RegCloseKey OpenServiceW CryptAcquireContextA CryptDeriveKey CryptReleaseContext RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CreateProcessAsUserW DuplicateTokenEx CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash FreeSid DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService

shell32

ShellExecuteExW Shell_NotifyIconW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData

ws2_32

WSACleanup accept WSAStartup bind listen getaddrinfo freeaddrinfo WSAGetLastError closesocket setsockopt send socket recv

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx

netapi32

NetApiBufferFree NetUserGetInfo

userenv

GetAllUsersProfileDirectoryW CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

SwitchToThread TlsSetValue TlsGetValue TlsAlloc TlsFree GetCurrentThread

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetCPInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_b3b257be31ab1eaf4fbd826b4baef377_coinminer_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

winhttp

ws2_32

crypt32

netapi32

userenv

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

generic