General
- Target 2026-07-08_e23af6e3eb7af347ea9bb073caaf5a19_cobalt-strike_icedid_njrat_satacom_vidar
- Size 1.2MB
- Sample260708-en2nxabs3k
- SHA256 0d6f93d8363dd11a676ac506963c96a1e3bae353434b7a1f036a2d31d86f7d7f
- MD5 e23af6e3eb7af347ea9bb073caaf5a19
- SHA1 6b60ae33be62e710a9212154223f1e0e7ed2ee27
- SHA512 36e289305a48d83fcd0bbb957e32296e53448fdc7c132875f6b4cec1430814b54cf719a701fde43cc742c7e35019ef1405dcce809a110a39e59c5d9f36b06fbe
- SSDEEP 12288:bht/zOw7HxFayOINqATt39jBCpIQAOCxgcZRC3gcZRCoClDZrUqp8kI2t:9t6KH9kIxBPQAOM/Xa/X+d4qpFVt
- TLSH T193552B2267DD17A8E4E3B579E5624733DAB2F841033086EF0770855B1FA27E1A97B381
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_e23af6e3eb7af347ea9bb073caaf5a19_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_e23af6e3eb7af347ea9bb073caaf5a19_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_e23af6e3eb7af347ea9bb073caaf5a19_cobalt-strike_icedid_njrat_satacom_vidar
- Size 1.2MB
- SHA256 0d6f93d8363dd11a676ac506963c96a1e3bae353434b7a1f036a2d31d86f7d7f
- MD5 e23af6e3eb7af347ea9bb073caaf5a19
- SHA1 6b60ae33be62e710a9212154223f1e0e7ed2ee27
- SHA512 36e289305a48d83fcd0bbb957e32296e53448fdc7c132875f6b4cec1430814b54cf719a701fde43cc742c7e35019ef1405dcce809a110a39e59c5d9f36b06fbe
- SSDEEP 12288:bht/zOw7HxFayOINqATt39jBCpIQAOCxgcZRC3gcZRCoClDZrUqp8kI2t:9t6KH9kIxBPQAOM/Xa/X+d4qpFVt
- TLSH T193552B2267DD17A8E4E3B579E5624733DAB2F841033086EF0770855B1FA27E1A97B381
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.