General
- Target 2026-07-11_e1bf081fb21c40e492a61cbb4592ca71_cobalt-strike_icedid_njrat_satacom_vidar
- Size 414KB
- Sample260711-c79shscy7v
- SHA256 0365f2e643aaf037137f8ef2143c2da3e5bcd147c0f1d093fa99963efa7dd3d5
- MD5 e1bf081fb21c40e492a61cbb4592ca71
- SHA1 ae1ac19312752b13275ce7c83488ca352050e66a
- SHA512 e96a981cf5d4056b5c4338ec1c6448f27d5b886167c112cd6a48540ff4da6901789f0cea22df9ddf0f7e929f188d99e4c09ede60d0b3c5657135890b6fc29f89
- SSDEEP 6144:vkzO0JSCN8D7ABgRJ32oGjY4Sqr6DnslJlkdoTlx+fqvQDFhsIK71cxluM:v6RdaI63FYRr6DGJSmp8EIKJcB
- TLSH T1C0940147B3E634F8D5B2473689A60A06D772B43216254BAF5748D33B1F233915E3AFA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_e1bf081fb21c40e492a61cbb4592ca71_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_e1bf081fb21c40e492a61cbb4592ca71_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_e1bf081fb21c40e492a61cbb4592ca71_cobalt-strike_icedid_njrat_satacom_vidar
- Size 414KB
- SHA256 0365f2e643aaf037137f8ef2143c2da3e5bcd147c0f1d093fa99963efa7dd3d5
- MD5 e1bf081fb21c40e492a61cbb4592ca71
- SHA1 ae1ac19312752b13275ce7c83488ca352050e66a
- SHA512 e96a981cf5d4056b5c4338ec1c6448f27d5b886167c112cd6a48540ff4da6901789f0cea22df9ddf0f7e929f188d99e4c09ede60d0b3c5657135890b6fc29f89
- SSDEEP 6144:vkzO0JSCN8D7ABgRJ32oGjY4Sqr6DnslJlkdoTlx+fqvQDFhsIK71cxluM:v6RdaI63FYRr6DGJSmp8EIKJcB
- TLSH T1C0940147B3E634F8D5B2473689A60A06D772B43216254BAF5748D33B1F233915E3AFA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.