General
- Target 2026-07-20_5083f07290dbbc56f1261c6a29e4ce79_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
- Size 1.6MB
- Sample260720-dn8a1sgs7t
- SHA256 819d01c26c722c93fcab4c64bfea7254a5ddd1003ebe2a71717c59080b49181b
- MD5 5083f07290dbbc56f1261c6a29e4ce79
- SHA1 b7c3ec5c110e2035ee753679c2474164aded943a
- SHA512 ae2ad8816cb71544791cf4ff1c8eea9b908876f946f5840955bca7bb2ef80631cf32f6fb3c7abfaae60703f1e5bfafe17768a5775693fc02168d7de71d72c6ba
- SSDEEP 24576:eHs5q8dXwwaWnEz0GhxEww3mbQXg5TpTv5uTc/cuoWLEkgXWHiYKbfZB1v3adCMW:eHs5/LaWEzVHEh2bK2pTETMcEcfT1S1
- TLSH T1E485CF07B69600FCD06DC1B8CB169532EA71B8850F31BAEF1790A3292E76AE45F3D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5083f07290dbbc56f1261c6a29e4ce79_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_5083f07290dbbc56f1261c6a29e4ce79_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
- Size 1.6MB
- SHA256 819d01c26c722c93fcab4c64bfea7254a5ddd1003ebe2a71717c59080b49181b
- MD5 5083f07290dbbc56f1261c6a29e4ce79
- SHA1 b7c3ec5c110e2035ee753679c2474164aded943a
- SHA512 ae2ad8816cb71544791cf4ff1c8eea9b908876f946f5840955bca7bb2ef80631cf32f6fb3c7abfaae60703f1e5bfafe17768a5775693fc02168d7de71d72c6ba
- SSDEEP 24576:eHs5q8dXwwaWnEz0GhxEww3mbQXg5TpTv5uTc/cuoWLEkgXWHiYKbfZB1v3adCMW:eHs5/LaWEzVHEh2bK2pTETMcEcfT1S1
- TLSH T1E485CF07B69600FCD06DC1B8CB169532EA71B8850F31BAEF1790A3292E76AE45F3D715
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1