General
- Target 2026-04-21_480da1b771cb25260c77eb29775fa913_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.6MB
- Sample260421-212k1agy6x
- SHA256 33a66aff0996c570c9b2768b5a8e67068e7d42dc05be9912f8006e23cece6350
- MD5 480da1b771cb25260c77eb29775fa913
- SHA1 77b1ec5c7b2efa8442c4790e6e4ca9341ca7c771
- SHA512 615b7e5d4b862263721ce6b100cd0181aff376179960a0ae0ac55ca55fa882ea39c76246cbdf67ed9fe80564441fcdfe46cffb1bea9715ed2c0c6ce4969fd14b
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1F0D51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-21_480da1b771cb25260c77eb29775fa913_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-21_480da1b771cb25260c77eb29775fa913_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.6MB
- SHA256 33a66aff0996c570c9b2768b5a8e67068e7d42dc05be9912f8006e23cece6350
- MD5 480da1b771cb25260c77eb29775fa913
- SHA1 77b1ec5c7b2efa8442c4790e6e4ca9341ca7c771
- SHA512 615b7e5d4b862263721ce6b100cd0181aff376179960a0ae0ac55ca55fa882ea39c76246cbdf67ed9fe80564441fcdfe46cffb1bea9715ed2c0c6ce4969fd14b
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1F0D51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE