2026-09-28_ef33556bd03ddb7b13d289811d2de88f_coinminer_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_ef33556bd03ddb7b13d289811d2de88f_coinminer_icedid_njrat
Size 16.7MB
Sample260928-14fx2ade27
SHA256 1b5091e4df1dd5ad92ed0ba9ec67e28dbd15ee2555235356db96b3d77ef9f652
MD5 ef33556bd03ddb7b13d289811d2de88f
SHA1 1b6eb2e730641c96dc2980d6bec55b67abf2fe4d
SHA512 bfcf10f73dae12c199036e8ab91f609779060bb8341991f8cb6a7bfdc4e74c7881cf1ab792737cd887dd1b05f4c3bcc6fdbe9eb5114e3d0aa033321db6e82be3
SSDEEP 98304:+nPLY8MuIISstxthOLjPyZLhuujuqpR1:yylsmqZLLpj
TLSH
T18E07D339B56941D2E1F6C07ED5930E2BEC2130AE033856EB514696C64F21BF9EE3C762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_ef33556bd03ddb7b13d289811d2de88f_coinminer_icedid_njrat

File Explorer

2026-09-28_ef33556bd03ddb7b13d289811d2de88f_coinminer_icedid_njrat

.exe 16.7MB

2026-09-28_ef33556bd03ddb7b13d289811d2de88f_coinminer_icedid_njrat

IMPHASH 177c7f35908c2376f1b20d230e631fb4
SHA256 1b5091e4df1dd5ad92ed0ba9ec67e28dbd15ee2555235356db96b3d77ef9f652
MD5 ef33556bd03ddb7b13d289811d2de88f
SHA1 1b6eb2e730641c96dc2980d6bec55b67abf2fe4d
SHA512 bfcf10f73dae12c199036e8ab91f609779060bb8341991f8cb6a7bfdc4e74c7881cf1ab792737cd887dd1b05f4c3bcc6fdbe9eb5114e3d0aa033321db6e82be3
SSDEEP 98304:+nPLY8MuIISstxthOLjPyZLhuujuqpR1:yylsmqZLLpj
TLSH
T18E07D339B56941D2E1F6C07ED5930E2BEC2130AE033856EB514696C64F21BF9EE3C762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6416626

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Authority\Desktop\RE stuff\KEVLAR\builds\Debug\KEVLAR.pdb

powrprof

CallNtPowerInformation

kernel32

GetModuleHandleExA ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe GetOverlappedResult CancelIoEx ResetEvent WaitForSingleObject CreateEventW CreateNamedPipeA MultiByteToWideChar CreateFileW GetFileInformationByHandle GetFileSizeEx SetFilePointerEx GetCurrentThread GetWindowsDirectoryW GetLogicalProcessorInformationEx EnumSystemFirmwareTables GetSystemFirmwareTable CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary LoadLibraryExW SetThreadGroupAffinity CreateHardLinkW GetActiveProcessorGroupCount GetActiveProcessorCount WideCharToMultiByte CreateDirectoryW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileType SetFileAttributesW SetFileTime CompareStringOrdinal GetProcessTimes GetCurrentProcess OpenProcess VirtualQueryEx ReadProcessMemory PssCaptureSnapshot PssFreeSnapshot PssQuerySnapshot lstrlenW GetFileAttributesW GetFileAttributesExW GetFinalPathNameByHandleW SetEndOfFile SetLastError GetFileInformationByHandleEx LCMapStringEx GetStdHandle FillConsoleOutputCharacterA GetModuleFileNameA GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime SetUnhandledExceptionFilter GetSystemDirectoryW GetConsoleMode SetConsoleMode SetConsoleCtrlHandler Sleep GetTickCount64 GetACP GetOEMCP MoveFileExW GetLocalTime SetWaitableTimer CreateWaitableTimerA GetSystemInfo VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection OpenThread LocalFree FormatMessageA GetLogicalProcessorInformation AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualProtect InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ResumeThread SetStdHandle QueryPerformanceFrequency QueryPerformanceCounter GetProcAddress GetModuleHandleW GetModuleFileNameW GetSystemTime GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage GetTimeZoneInformation ReadConsoleW ExitThread GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW GetCurrentProcessId SetEnvironmentVariableW FillConsoleOutputAttribute HeapQueryInformation HeapReAlloc GetCommandLineW GetCommandLineA ExitProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW CopyFileW CreateSymbolicLinkW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared SleepConditionVariableSRW RtlPcToFileHeader RaiseException InitializeCriticalSectionEx InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait EncodePointer DecodePointer GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead HeapAlloc HeapFree GetProcessHeap VirtualQuery RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetModuleHandleExW WriteConsoleW CreateThread FreeLibraryAndExitThread

advapi32

RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW EventAccessQuery RegQueryValueExW RegEnumKeyExW

bcrypt

BCryptFinishHash BCryptOpenAlgorithmProvider BCryptHash BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wintrust

WinVerifyTrust

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

iphlpapi

FreeMibTable GetIfTable2

rpcrt4

UuidFromStringA UuidCreateSequential

urlmon

URLDownloadToFileW

Name

.textbss

Size

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

12.5MB

Virtual Size

12.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

763KB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

813KB

Virtual Size

812KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

fakek

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

hookacce

Size

1024B

Virtual Size

757B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_ef33556bd03ddb7b13d289811d2de88f_coinminer_icedid_njrat

powrprof

kernel32

advapi32

bcrypt

version

wintrust

setupapi

iphlpapi

rpcrt4

urlmon

generic