General
- Target 2026-06-30_3498aef044a96fc7447213c23c3fb946_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
- Size 1.6MB
- Sample260630-3ks5csby6w
- SHA256 98d6c646218a95e00608b20cb9f52053730cde1aafd5e2e1dfefdfc037b88acf
- MD5 3498aef044a96fc7447213c23c3fb946
- SHA1 5d2cfe0be1cc59feb0f058287d047c84a3a091a5
- SHA512 eefcd13ad4a2edee56235480a76b959eaabd84e853494f06f931bfdc541cc489c8ec887cce8884d9fcb20246fd3f71b416b5f6e0857fd26d52db48bec2fefbb8
- SSDEEP 24576:xVT0AYyRE9Wx/tEX6PoC0jIMuF+pD3eBR8nvn9ZyXLYKM/s7q:x10AYDWxyXGohjIM3JOBR8nv9PU
- TLSH T13875BE0BB25118EAC2A9C074CE16D531A761BC4E0BF269FB3591F2D92D36AD07F39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_3498aef044a96fc7447213c23c3fb946_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_3498aef044a96fc7447213c23c3fb946_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
- Size 1.6MB
- SHA256 98d6c646218a95e00608b20cb9f52053730cde1aafd5e2e1dfefdfc037b88acf
- MD5 3498aef044a96fc7447213c23c3fb946
- SHA1 5d2cfe0be1cc59feb0f058287d047c84a3a091a5
- SHA512 eefcd13ad4a2edee56235480a76b959eaabd84e853494f06f931bfdc541cc489c8ec887cce8884d9fcb20246fd3f71b416b5f6e0857fd26d52db48bec2fefbb8
- SSDEEP 24576:xVT0AYyRE9Wx/tEX6PoC0jIMuF+pD3eBR8nvn9ZyXLYKM/s7q:x10AYDWxyXGohjIM3JOBR8nv9PU
- TLSH T13875BE0BB25118EAC2A9C074CE16D531A761BC4E0BF269FB3591F2D92D36AD07F39711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1