General
- Target 2026-08-03_d2a7f954a7b4898012c96d48e692a480_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.9MB
- Sample260804-lhz2fssvft
- SHA256 e25e45cff664957faca0fa997a96cc71211e1b3afd701d566c6250e4c4867b43
- MD5 d2a7f954a7b4898012c96d48e692a480
- SHA1 c5914060d3b03ff1e31ff8d41a51572f81747710
- SHA512 27f0c110c01940b96440e0fd783b4ac43f464894a7ebd0eb9adfde0f869ad283b12695e26ce29b809b11e99870248af7de01da525c1bb1d2af1e341a1d2b3db3
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T197E51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_d2a7f954a7b4898012c96d48e692a480_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_d2a7f954a7b4898012c96d48e692a480_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.9MB
- SHA256 e25e45cff664957faca0fa997a96cc71211e1b3afd701d566c6250e4c4867b43
- MD5 d2a7f954a7b4898012c96d48e692a480
- SHA1 c5914060d3b03ff1e31ff8d41a51572f81747710
- SHA512 27f0c110c01940b96440e0fd783b4ac43f464894a7ebd0eb9adfde0f869ad283b12695e26ce29b809b11e99870248af7de01da525c1bb1d2af1e341a1d2b3db3
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T197E51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE