General
- Target 2026-07-28_3f5ae582da4c6db171f883007fae3276_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.9MB
- Sample260729-bsqknattaw
- SHA256 07acadb2649336f7f7d6ac34263310667c4138e391d010b8c25fe9612163585e
- MD5 3f5ae582da4c6db171f883007fae3276
- SHA1 dae0a95e590c63eeae1974243a035a4c9a9277e7
- SHA512 cce1dadbbbd14d113769c8c1c6b3ee08d3f3e604842cca7bcd671fc66f2326bdfaee7e3bf07e6dd02f78de693e3c4af8d9cf76e9f7130737dd91a6c003e701ad
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1F5E51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_3f5ae582da4c6db171f883007fae3276_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_3f5ae582da4c6db171f883007fae3276_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.9MB
- SHA256 07acadb2649336f7f7d6ac34263310667c4138e391d010b8c25fe9612163585e
- MD5 3f5ae582da4c6db171f883007fae3276
- SHA1 dae0a95e590c63eeae1974243a035a4c9a9277e7
- SHA512 cce1dadbbbd14d113769c8c1c6b3ee08d3f3e604842cca7bcd671fc66f2326bdfaee7e3bf07e6dd02f78de693e3c4af8d9cf76e9f7130737dd91a6c003e701ad
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1F5E51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE