General
- Target 2026-08-13_835b4e778e33a7a62403d521e05d5912_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 3.0MB
- Sample260813-py9glszene
- SHA256 c75cd42f6b97d349ae25f1279c0a5c7bc515fbae00dd305b73fc1cecac772c8c
- MD5 835b4e778e33a7a62403d521e05d5912
- SHA1 2dc811d889c7e51a149676094b0f7673618e8080
- SHA512 5e4cce661ba964f1fd01ffe6bd0a08c55bcc1f90e4e0e65f63e039f4380e42f3b9888ad8967ac1ed17430b7fa6d795e0cd1720aeea7d8d4d7f36899285139fec
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T14DE51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_835b4e778e33a7a62403d521e05d5912_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-13_835b4e778e33a7a62403d521e05d5912_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 3.0MB
- SHA256 c75cd42f6b97d349ae25f1279c0a5c7bc515fbae00dd305b73fc1cecac772c8c
- MD5 835b4e778e33a7a62403d521e05d5912
- SHA1 2dc811d889c7e51a149676094b0f7673618e8080
- SHA512 5e4cce661ba964f1fd01ffe6bd0a08c55bcc1f90e4e0e65f63e039f4380e42f3b9888ad8967ac1ed17430b7fa6d795e0cd1720aeea7d8d4d7f36899285139fec
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T14DE51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE