General
- Target 2026-05-07_1411f145bc36f23e55c32a7cf85255a2_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.6MB
- Sample260507-fs6dbsfs4x
- SHA256 16d30639e9a9b40751b81e4f4c3cdbf8c6b10afac7d26ef5a14e276ca5d8cc7f
- MD5 1411f145bc36f23e55c32a7cf85255a2
- SHA1 fdbb274184a75d9eb7204041258ad4e80b849e18
- SHA512 7abb580695786d0cea5b92f2c84a80490fc0019b6c85d34165033f19cee73a3076799ba99a13bf8c736570d6b98eb551985d2942b0e4ec51c0b2e6c81f5f0c96
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1FCD51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-07_1411f145bc36f23e55c32a7cf85255a2_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-07_1411f145bc36f23e55c32a7cf85255a2_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.6MB
- SHA256 16d30639e9a9b40751b81e4f4c3cdbf8c6b10afac7d26ef5a14e276ca5d8cc7f
- MD5 1411f145bc36f23e55c32a7cf85255a2
- SHA1 fdbb274184a75d9eb7204041258ad4e80b849e18
- SHA512 7abb580695786d0cea5b92f2c84a80490fc0019b6c85d34165033f19cee73a3076799ba99a13bf8c736570d6b98eb551985d2942b0e4ec51c0b2e6c81f5f0c96
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1FCD51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
XMRig Miner payload
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE