General
- Target 2026-07-08_24bf56f35181eae8fae815d6ce85df66_amadey_cobalt-strike_fabookie_hijackloader_icedid_njrat_satacom_vidar
- Size 2.8MB
- Sample260708-w35gsaez2n
- SHA256 e85c7071a130c8a4fb8c707be51d6bbf3a47b8535195ad022666a9e1f46e596c
- MD5 24bf56f35181eae8fae815d6ce85df66
- SHA1 95f231ca02334cc8b3a8f4ce8a78d28b5347b7be
- SHA512 5f1013d25d669dd94071f462bd864012c391afed7fbe30f3e46fb3effa69fe49901056bdb3cfb7328973d11079259ada92557d4fb95adc8a4eda1725288548ba
- SSDEEP 49152:/2CWlIssZLi5lKr+Uv9MxcY/QAPji0AjP5ta1LR:xGUv9Lr+joT5ta1t
- TLSH T1CAD53A11B6644971D462C2358992FA9EE5323D0197328ECF22827E9EFFB37D19936331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_24bf56f35181eae8fae815d6ce85df66_amadey_cobalt-strike_fabookie_hijackloader_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_24bf56f35181eae8fae815d6ce85df66_amadey_cobalt-strike_fabookie_hijackloader_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_24bf56f35181eae8fae815d6ce85df66_amadey_cobalt-strike_fabookie_hijackloader_icedid_njrat_satacom_vidar
- Size 2.8MB
- SHA256 e85c7071a130c8a4fb8c707be51d6bbf3a47b8535195ad022666a9e1f46e596c
- MD5 24bf56f35181eae8fae815d6ce85df66
- SHA1 95f231ca02334cc8b3a8f4ce8a78d28b5347b7be
- SHA512 5f1013d25d669dd94071f462bd864012c391afed7fbe30f3e46fb3effa69fe49901056bdb3cfb7328973d11079259ada92557d4fb95adc8a4eda1725288548ba
- SSDEEP 49152:/2CWlIssZLi5lKr+Uv9MxcY/QAPji0AjP5ta1LR:xGUv9Lr+joT5ta1t
- TLSH T1CAD53A11B6644971D462C2358992FA9EE5323D0197328ECF22827E9EFFB37D19936331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.