2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar
Size 2.3MB
Sample261009-xcghpsdf77
SHA256 69d22f10039c1534e4495b5f125eec9f996b2ddb2ae2c99cb9b727895e328e63
MD5 2895e449eba5b160c5b4a1537e6ad27d
SHA1 b0f6b44351007c5ed57345ab1b698889ccdaac41
SHA512 2c4ea6b244163320bc2f56387b4eb0f6e220570c3dba0ef94e782e4f6ad59b08384c288f0fb76630d205129fcaffd8b9cfec24eeeb722c5cb507245ca9c1c95a
SSDEEP 49152:SR/gNy7gdyzDLET9ZniLNuX22c1QTkk0MMv98/e7m6n4IeoXw:2/gNxd7XT25Y/eKITN
TLSH
T181B5BF4A765841E8D177C13DCA569A86E6B17C061F20A7DF13A837DE2F336E05A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar

File Explorer

2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar

.exe 2.3MB

2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar

IMPHASH 62463b33ecaad0e38df723c22381528d
SHA256 69d22f10039c1534e4495b5f125eec9f996b2ddb2ae2c99cb9b727895e328e63
MD5 2895e449eba5b160c5b4a1537e6ad27d
SHA1 b0f6b44351007c5ed57345ab1b698889ccdaac41
SHA512 2c4ea6b244163320bc2f56387b4eb0f6e220570c3dba0ef94e782e4f6ad59b08384c288f0fb76630d205129fcaffd8b9cfec24eeeb722c5cb507245ca9c1c95a
SSDEEP 49152:SR/gNy7gdyzDLET9ZniLNuX22c1QTkk0MMv98/e7m6n4IeoXw:2/gNxd7XT25Y/eKITN
TLSH
T181B5BF4A765841E8D177C13DCA569A86E6B17C061F20A7DF13A837DE2F336E05A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

807592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\project\sogouime\dev_11.7_quality_modify\Src2\Output\IME\Release\Install64.pdb

imm32

ImmInstallIMEW ImmGetIMEFileNameW ImmDisableIME

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

LocalFree DecodePointer RaiseException CloseHandle GlobalFree GlobalAlloc GetLastError GetSystemDirectoryW InitializeCriticalSectionAndSpinCount GetCurrentProcess GetCommandLineW LoadLibraryExW FreeLibrary GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection TerminateThread TlsSetValue TlsGetValue TlsAlloc TlsFree GetModuleFileNameW GetTempPathW CreateToolhelp32Snapshot Process32NextW Process32FirstW LoadLibraryW GetCurrentProcessId OpenMutexW ReadFile SetLastError WriteFile SetFilePointer CreateFileW GetCurrentThreadId DuplicateHandle ExitThread CreateEventW FormatMessageW CreateThread GetFileSize MultiByteToWideChar WideCharToMultiByte QueryDosDeviceW FindFirstFileW FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW GetEnvironmentVariableW SetFileAttributesW GetLogicalDriveStringsW MoveFileExW GetTempFileNameW CreateDirectoryW SetFileTime GetProcessId WaitForSingleObject Sleep GetFileAttributesExW FileTimeToSystemTime DeleteFileW SystemTimeToFileTime CreateProcessW CopyFileW GetFileTime GetExitCodeProcess CreateMutexW ReleaseMutex LocalAlloc GetVersionExW GetWindowsDirectoryW FlushFileBuffers VirtualAlloc QueryPerformanceFrequency QueryPerformanceCounter InitializeCriticalSection OpenFileMappingW UnmapViewOfFile FlushViewOfFile CreateFileMappingW MapViewOfFile SetEvent GetSystemTimeAsFileTime GetTickCount EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetCurrentThread HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleFileNameA GetStdHandle GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetFilePointerEx GetConsoleMode ReadConsoleW IsValidCodePage GetOEMCP GetProcessHeap SetConsoleCtrlHandler FindFirstFileExA FindFirstFileExW FindNextFileA GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA SetStdHandle HeapSize GetConsoleCP SetEndOfFile WriteConsoleW DeleteCriticalSection OpenProcess

user32

GetDC SendMessageTimeoutW GetWindowRect FindWindowExW MonitorFromPoint GetWindowThreadProcessId GetWindowLongW WindowFromPoint TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW wsprintfW GetSystemMetrics IsWindowVisible SetWindowPos EnumWindows GetClassNameW GetDesktopWindow SystemParametersInfoW GetForegroundWindow MonitorFromRect MonitorFromWindow IsIconic MessageBoxW UnregisterClassW GetKeyboardLayoutList UnloadKeyboardLayout LoadStringW DestroyIcon GetParent SetForegroundWindow ShowWindow GetMonitorInfoW AttachThreadInput SetRectEmpty ReleaseDC

advapi32

RegEnumKeyW RegEnumKeyExW RegSetValueExW OpenProcessToken GetSecurityDescriptorSacl SetSecurityDescriptorDacl BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityDescriptorSacl RegUnLoadKeyW RegLoadKeyW RegOpenKeyExW RegCreateKeyW ConvertSidToStringSidW RegOpenKeyW RegEnumValueW RegQueryValueExW GetTokenInformation LookupAccountNameW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW RegFlushKey InitializeSecurityDescriptor InitializeAcl SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid RegDeleteValueW LookupAccountSidW

shell32

SHFileOperationW ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

psapi

GetModuleInformation GetModuleFileNameExW

gdi32

DeleteDC BitBlt SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetDeviceCaps DeleteObject

ole32

CoUninitialize CoInitialize CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar

imm32

wtsapi32

version

kernel32

user32

advapi32

shell32

oleaut32

psapi

gdi32

ole32

generic