General
- Target 2026-07-15_b584a103b65d9fb7385f67b7350d4895_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- Sample260716-bxtg4sat9m
- SHA256 857d58de9944966cb0869fc3fa44c787e99fd6ca3d063bd6375d6968204a0372
- MD5 b584a103b65d9fb7385f67b7350d4895
- SHA1 13fdcfe4556a9631cc8de6812297b19b46814198
- SHA512 179b5ba71b4cd3f6d4dba2f55249c25695ee5975a51d2bb80b8408a253dd91f485b2484842bdf7b96ebb524623f78a58bb5dbfcc77824bf184a1f93c2fcc74da
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7S:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ4k
- TLSH T1FBC51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_b584a103b65d9fb7385f67b7350d4895_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_b584a103b65d9fb7385f67b7350d4895_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- SHA256 857d58de9944966cb0869fc3fa44c787e99fd6ca3d063bd6375d6968204a0372
- MD5 b584a103b65d9fb7385f67b7350d4895
- SHA1 13fdcfe4556a9631cc8de6812297b19b46814198
- SHA512 179b5ba71b4cd3f6d4dba2f55249c25695ee5975a51d2bb80b8408a253dd91f485b2484842bdf7b96ebb524623f78a58bb5dbfcc77824bf184a1f93c2fcc74da
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7S:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ4k
- TLSH T1FBC51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE