General
- Target 2026-05-28_dbaa4e111c53e6daae5277a4f6da7de6_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 12.8MB
- Sample260528-vz4kmsgw7r
- SHA256 61145ffd8584f8f7eee1d5164e710748ffd40d7d5781ab1d51bf5c89208826f4
- MD5 dbaa4e111c53e6daae5277a4f6da7de6
- SHA1 83be59e994c908716a6bdaa60aaaa9a3eb5fa9d3
- SHA512 8a5f442dc95206463e1f9ecadd6d41a4ff38e5e2f918ceb3853044d13737330658e5e1d7b1650924551e356bf597f85a706690abc3e59cab63f52b072e728f9d
- SSDEEP 393216:LqaGlO7nZRfbLUQuwY4W6Ix7T/B3XpNHIIVLcWf:Lqps7ZRfbAQv46+7Tp3XXHTVLx
- TLSH T137D6335973AA44FDD237CA39C9844292E625BC4A2395E2AF13D477273F372B04B36721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-28_dbaa4e111c53e6daae5277a4f6da7de6_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-28_dbaa4e111c53e6daae5277a4f6da7de6_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 12.8MB
- SHA256 61145ffd8584f8f7eee1d5164e710748ffd40d7d5781ab1d51bf5c89208826f4
- MD5 dbaa4e111c53e6daae5277a4f6da7de6
- SHA1 83be59e994c908716a6bdaa60aaaa9a3eb5fa9d3
- SHA512 8a5f442dc95206463e1f9ecadd6d41a4ff38e5e2f918ceb3853044d13737330658e5e1d7b1650924551e356bf597f85a706690abc3e59cab63f52b072e728f9d
- SSDEEP 393216:LqaGlO7nZRfbLUQuwY4W6Ix7T/B3XpNHIIVLcWf:Lqps7ZRfbAQv46+7Tp3XXHTVLx
- TLSH T137D6335973AA44FDD237CA39C9844292E625BC4A2395E2AF13D477273F372B04B36721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.