General
- Target 2026-07-07_5b1ff71856663e2b37ba48dd94aaffc7_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar
- Size 1.8MB
- Sample260707-zee4rses2w
- SHA256 68267d60f1f0497dee7bb8a1fbe930d54b974f1ee0ee5756c268f4cb8d0e30b1
- MD5 5b1ff71856663e2b37ba48dd94aaffc7
- SHA1 8501aa624653bca40471c275f7aca2c30886c536
- SHA512 1a8e6fa117801067c89e51a02ebaf47f23f622df24d0ed56b96d69d1611f68771c15e643c78ffa1e8388f5ecd6a36203e77f9b6703caf816494adba0cce99b67
- SSDEEP 24576:W5jcAkSYqyEgt1+qwJ0Le5ji0hmxNrM9E+9xYcLP:cpYqKwqSPji0Aj+YcLP
- TLSH T1B1955C25F6F44E22E0B3C1BAC9E2A649DD3234460734D6CF129A876D2E277D18937772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_5b1ff71856663e2b37ba48dd94aaffc7_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_5b1ff71856663e2b37ba48dd94aaffc7_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_5b1ff71856663e2b37ba48dd94aaffc7_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar
- Size 1.8MB
- SHA256 68267d60f1f0497dee7bb8a1fbe930d54b974f1ee0ee5756c268f4cb8d0e30b1
- MD5 5b1ff71856663e2b37ba48dd94aaffc7
- SHA1 8501aa624653bca40471c275f7aca2c30886c536
- SHA512 1a8e6fa117801067c89e51a02ebaf47f23f622df24d0ed56b96d69d1611f68771c15e643c78ffa1e8388f5ecd6a36203e77f9b6703caf816494adba0cce99b67
- SSDEEP 24576:W5jcAkSYqyEgt1+qwJ0Le5ji0hmxNrM9E+9xYcLP:cpYqKwqSPji0Aj+YcLP
- TLSH T1B1955C25F6F44E22E0B3C1BAC9E2A649DD3234460734D6CF129A876D2E277D18937772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.