General
- Target 2026-07-11_ae9fbd3df4a2181af62cbabb9a485f02_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
- Size 1.6MB
- Sample260711-ewgnpsbt8n
- SHA256 b1cccef318a9b6340e09ea67d517096377958e080f7ab1177f0e5e42615c35bb
- MD5 ae9fbd3df4a2181af62cbabb9a485f02
- SHA1 8b4c3e8159373eab5f36fe7e5b0d08db15fb8237
- SHA512 bc6f1cc5774635e85aaac5c2db137687bd78fb2de77a2f58b2e0aaeda050e384f77da68ac2918cf5b68f1650e701d97d1db650b51f1daed2d4751f51068c6c8a
- SSDEEP 24576:mVT0AYyRE9qx/tEX6PoC0jIMu0AGzr55oLGh+3ZZ4OAI:m10AYDqxyXGohjIMAW52LGgp9AI
- TLSH T10375BF0BB26118EAC2A9C074CE1AC5319761BC4D0BF269FB3581F6D92D36AD07F39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_ae9fbd3df4a2181af62cbabb9a485f02_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_ae9fbd3df4a2181af62cbabb9a485f02_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_ae9fbd3df4a2181af62cbabb9a485f02_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
- Size 1.6MB
- SHA256 b1cccef318a9b6340e09ea67d517096377958e080f7ab1177f0e5e42615c35bb
- MD5 ae9fbd3df4a2181af62cbabb9a485f02
- SHA1 8b4c3e8159373eab5f36fe7e5b0d08db15fb8237
- SHA512 bc6f1cc5774635e85aaac5c2db137687bd78fb2de77a2f58b2e0aaeda050e384f77da68ac2918cf5b68f1650e701d97d1db650b51f1daed2d4751f51068c6c8a
- SSDEEP 24576:mVT0AYyRE9qx/tEX6PoC0jIMu0AGzr55oLGh+3ZZ4OAI:m10AYDqxyXGohjIMAW52LGgp9AI
- TLSH T10375BF0BB26118EAC2A9C074CE1AC5319761BC4D0BF269FB3581F6D92D36AD07F39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1