General
- Target 2026-08-23_4a78f00c217600ce3f072622b9894aec_cobalt-strike_icedid_njrat_satacom_vidar
- Size 530KB
- Sample260824-pmxzfattdz
- SHA256 ef4c42c4a8fb578e34e27c656fc1e8663756e330b1ee3ee0731976202536cf81
- MD5 4a78f00c217600ce3f072622b9894aec
- SHA1 34f4fb9a31fcbc909f281fb3716e80fdd4bff8be
- SHA512 3de528fcc2640bbfa26cf0fe6b70c823cbc481331c71bccd9cbdc4cc8bfe5f68cdad6a5f2f73e9b143649dafba0e6ecbbbb4c956f8c5ee08e720bd7e3736191c
- SSDEEP 6144:I1Z1cnsCu4u0PHx9vOPFnwKfnsU+T9aOrcoh4Cjl69eNjlf8yhxxWlZ1lQstrIaM:+ZinsCuFyPvO+KkU+OoZ69ujl0A8RXO
- TLSH T171C47C5AF2A510F9E4B7C278C9625A42F7B27C2507709BDF53A0426A1F23BE09D3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_4a78f00c217600ce3f072622b9894aec_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_4a78f00c217600ce3f072622b9894aec_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_4a78f00c217600ce3f072622b9894aec_cobalt-strike_icedid_njrat_satacom_vidar
- Size 530KB
- SHA256 ef4c42c4a8fb578e34e27c656fc1e8663756e330b1ee3ee0731976202536cf81
- MD5 4a78f00c217600ce3f072622b9894aec
- SHA1 34f4fb9a31fcbc909f281fb3716e80fdd4bff8be
- SHA512 3de528fcc2640bbfa26cf0fe6b70c823cbc481331c71bccd9cbdc4cc8bfe5f68cdad6a5f2f73e9b143649dafba0e6ecbbbb4c956f8c5ee08e720bd7e3736191c
- SSDEEP 6144:I1Z1cnsCu4u0PHx9vOPFnwKfnsU+T9aOrcoh4Cjl69eNjlf8yhxxWlZ1lQstrIaM:+ZinsCuFyPvO+KkU+OoZ69ujl0A8RXO
- TLSH T171C47C5AF2A510F9E4B7C278C9625A42F7B27C2507709BDF53A0426A1F23BE09D3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.