General
- Target 2026-07-22_8992f56bafc0eb58e3691fdfe3c313c5_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- Sample260722-3l9thaaq2w
- SHA256 255f404bbe0f049f9fdefc1e8ecd1a0dd9990bb479981cffb322d9cd71e64963
- MD5 8992f56bafc0eb58e3691fdfe3c313c5
- SHA1 d4772bf7719419980ddd082d821cb12d8e308bd6
- SHA512 d35ba61139c13c73cfa84774bd4cfa11ed8ea594ba63e5c38d56406b49c4af797047c6bdbaf76ae7ff72a6e2c63594da130d9be967933df7403f41358a8aad05
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7C:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ44
- TLSH T10AC51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_8992f56bafc0eb58e3691fdfe3c313c5_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_8992f56bafc0eb58e3691fdfe3c313c5_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.5MB
- SHA256 255f404bbe0f049f9fdefc1e8ecd1a0dd9990bb479981cffb322d9cd71e64963
- MD5 8992f56bafc0eb58e3691fdfe3c313c5
- SHA1 d4772bf7719419980ddd082d821cb12d8e308bd6
- SHA512 d35ba61139c13c73cfa84774bd4cfa11ed8ea594ba63e5c38d56406b49c4af797047c6bdbaf76ae7ff72a6e2c63594da130d9be967933df7403f41358a8aad05
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7C:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ44
- TLSH T10AC51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE