General
- Target 2026-07-27_2c0e323225b578d300b6bc9a372fbb3f_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.9MB
- Sample260727-y17v8sda95
- SHA256 d41ae197e42d411c26175e3a8e98410104d59664fb733b048e0f0dcd3dd10ff8
- MD5 2c0e323225b578d300b6bc9a372fbb3f
- SHA1 b27de41bece628259bfd9913e09b0bc986479120
- SHA512 683d0db3b12ef6fca088f67d86185f533fbda9c299b4cc606b299c01661025c7c766635b3912eb472c36f7a43fff956c65744f1914e3b1f43ad5612ae4bf823d
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1A5D51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_2c0e323225b578d300b6bc9a372fbb3f_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_2c0e323225b578d300b6bc9a372fbb3f_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.9MB
- SHA256 d41ae197e42d411c26175e3a8e98410104d59664fb733b048e0f0dcd3dd10ff8
- MD5 2c0e323225b578d300b6bc9a372fbb3f
- SHA1 b27de41bece628259bfd9913e09b0bc986479120
- SHA512 683d0db3b12ef6fca088f67d86185f533fbda9c299b4cc606b299c01661025c7c766635b3912eb472c36f7a43fff956c65744f1914e3b1f43ad5612ae4bf823d
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1A5D51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE