12925529f352a9af0058e4b2caaf4e37f56711848644c87a14fcf2cceafff69b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 03:51

Target
2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Size 459KB
Sample260820-eelakael2y
SHA256 12925529f352a9af0058e4b2caaf4e37f56711848644c87a14fcf2cceafff69b
MD5 0f137925c3432a4f0604f9d25f5d6e6e
SHA1 176c56318c604481eee9f42be213d03252c845c8
SHA512 6a4b51ad45d888ffb59be52caa5b8e29f15981396da6bf3dc7df16196b7a0dcb43a437731a171d0a7c84c83e947bbcfdbad9985c7ce8075058596519f5b09edc
SSDEEP 6144:hAELUPajm1wFf+8vpA5XlNHfWiknC5LWGHe81RfYjWvl2bsc5UrJy:hA3ParQ8vp+LfWdnuL+83YTD2Jy
TLSH
T198A48D4AB3A454F4E837D538CC424666E6767C168B60DB9F13A4772A3F332E05E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts_on.cmd	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\hosts_off.cmd	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\hosts_off.cmd	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240656359	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\softcell-design.url	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\softcell-design.url	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\hosts_on.cmd	2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_0f137925c3432a4f0604f9d25f5d6e6e_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in Windows directory
PID:4128