General
- Target 2026-08-24_81a99293ff59d2c8aebcf8ffb3326d0b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.6MB
- Sample260825-k45cmawtes
- SHA256 5508015d339c8072c17817040ebe910015a89065a536670e6218e92b3c6cce13
- MD5 81a99293ff59d2c8aebcf8ffb3326d0b
- SHA1 236e6f76a36be44005b1b356814100cd83d5c98a
- SHA512 bddc8468dfea865309afc70ea60cb09fdf404ed33efa80cfcc5fe437fc8bd0e2325023b06a299b5d7355833cf6ad7b83e62002e124ce007fa9004681243db698
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ4x
- TLSH T192C51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_81a99293ff59d2c8aebcf8ffb3326d0b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-24_81a99293ff59d2c8aebcf8ffb3326d0b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.6MB
- SHA256 5508015d339c8072c17817040ebe910015a89065a536670e6218e92b3c6cce13
- MD5 81a99293ff59d2c8aebcf8ffb3326d0b
- SHA1 236e6f76a36be44005b1b356814100cd83d5c98a
- SHA512 bddc8468dfea865309afc70ea60cb09fdf404ed33efa80cfcc5fe437fc8bd0e2325023b06a299b5d7355833cf6ad7b83e62002e124ce007fa9004681243db698
- SSDEEP 49152:kDjlabwz9/8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7:0qwKaZ9XANzQxNEGYTy/CRxMkLC4FQ4x
- TLSH T192C51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE