General
- Target 2026-06-28_9cc5df999d44e28d583dabe85f83dfa0_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- Sample260628-y355esd19l
- SHA256 1b60763a3c484b726a99debf809589e66ee0e73b7c7df32d5d0ce81d41bce7cd
- MD5 9cc5df999d44e28d583dabe85f83dfa0
- SHA1 be4178e1bd9889aa4b6c48be7e6a0fe43bb85ee3
- SHA512 b3b392d49c6969cfc2376003bb9cc62fa903cdf1bcaf453d8ebbd676b9f0fa02aefc533cb43b0f88811ac5e7ecfb2d08d7bbb89cae138da4fa11830e80189279
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ70:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ4+
- TLSH T111C51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_9cc5df999d44e28d583dabe85f83dfa0_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_9cc5df999d44e28d583dabe85f83dfa0_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- SHA256 1b60763a3c484b726a99debf809589e66ee0e73b7c7df32d5d0ce81d41bce7cd
- MD5 9cc5df999d44e28d583dabe85f83dfa0
- SHA1 be4178e1bd9889aa4b6c48be7e6a0fe43bb85ee3
- SHA512 b3b392d49c6969cfc2376003bb9cc62fa903cdf1bcaf453d8ebbd676b9f0fa02aefc533cb43b0f88811ac5e7ecfb2d08d7bbb89cae138da4fa11830e80189279
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ70:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ4+
- TLSH T111C51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE