General
- Target 2026-07-30_a1ef4d535314e67e282f6a13798fc8bc_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 49.8MB
- Sample260730-bp4m4szwcs
- SHA256 c49ac31d3aff1000b2fb8eea0d4a06eb77028bbe3fbb00ece6c787a93e7f42f8
- MD5 a1ef4d535314e67e282f6a13798fc8bc
- SHA1 cf7d4bb019eb7594350fd0dfca3f8c55ebe2ce1d
- SHA512 203e172c2ba5f129bab92a335233357f742209de51e20f0d937d34c5b4f21299e10448045fef50d701dcbadec0ff7959a57875b7eedfd88894550db7339e5eab
- SSDEEP 1572864:u3U9vrZYx64LjPn6eLJ04SyV+ZL4VSmtqdNu0U9Fow80R:GorWJLDnDLkdNu0080R
- TLSH T101B733E922D278A5C959CD34285487A5F3227C308F36EFCB167C1E21299A7F8AD7D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_a1ef4d535314e67e282f6a13798fc8bc_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_a1ef4d535314e67e282f6a13798fc8bc_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_a1ef4d535314e67e282f6a13798fc8bc_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 49.8MB
- SHA256 c49ac31d3aff1000b2fb8eea0d4a06eb77028bbe3fbb00ece6c787a93e7f42f8
- MD5 a1ef4d535314e67e282f6a13798fc8bc
- SHA1 cf7d4bb019eb7594350fd0dfca3f8c55ebe2ce1d
- SHA512 203e172c2ba5f129bab92a335233357f742209de51e20f0d937d34c5b4f21299e10448045fef50d701dcbadec0ff7959a57875b7eedfd88894550db7339e5eab
- SSDEEP 1572864:u3U9vrZYx64LjPn6eLJ04SyV+ZL4VSmtqdNu0U9Fow80R:GorWJLDnDLkdNu0080R
- TLSH T101B733E922D278A5C959CD34285487A5F3227C308F36EFCB167C1E21299A7F8AD7D710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.