General
- Target 2026-07-05_512519e966ee72df734a42a72681d6ce_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- Sample260705-mbemlsby4y
- SHA256 34b805248d579ecb0ec0de60172df551210488e62718bf3ec8dd679e72ac5a76
- MD5 512519e966ee72df734a42a72681d6ce
- SHA1 2db01ff106f4265abd2ff4f1a532eeb44e5027d2
- SHA512 3a7b26c9a405982684f5ff87ccbdd263d826fcdbd5b919199b2082b78a074e09cebf17e22d5e87a77cb1267702a5c6efb335509f2f435d1a06fdaf36795b8495
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7r:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ41
- TLSH T1FAC51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_512519e966ee72df734a42a72681d6ce_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_512519e966ee72df734a42a72681d6ce_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- SHA256 34b805248d579ecb0ec0de60172df551210488e62718bf3ec8dd679e72ac5a76
- MD5 512519e966ee72df734a42a72681d6ce
- SHA1 2db01ff106f4265abd2ff4f1a532eeb44e5027d2
- SHA512 3a7b26c9a405982684f5ff87ccbdd263d826fcdbd5b919199b2082b78a074e09cebf17e22d5e87a77cb1267702a5c6efb335509f2f435d1a06fdaf36795b8495
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7r:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ41
- TLSH T1FAC51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE