General
- Target 2026-09-04_b3f5e0e9eb3fefaf97dfe4673b5ae4fa_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.7MB
- Sample260904-3t9hpsserg
- SHA256 8ad2a5a0a56d2417ce06d1f32ce4faaa1c548a2c9c6b976d46bf9d9d864721db
- MD5 b3f5e0e9eb3fefaf97dfe4673b5ae4fa
- SHA1 06ca293606eb608f90212ce44b5d4eecb997b7e7
- SHA512 eb16afedf21625a3d6847a3051b74b8c45844bdf719c486cb927c60440110c91c54e180acde6803109a26d4ad84a6c16c67855ea56a15d6fc0f6e8f3f0b96a0c
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T12DD51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_b3f5e0e9eb3fefaf97dfe4673b5ae4fa_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-04_b3f5e0e9eb3fefaf97dfe4673b5ae4fa_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.7MB
- SHA256 8ad2a5a0a56d2417ce06d1f32ce4faaa1c548a2c9c6b976d46bf9d9d864721db
- MD5 b3f5e0e9eb3fefaf97dfe4673b5ae4fa
- SHA1 06ca293606eb608f90212ce44b5d4eecb997b7e7
- SHA512 eb16afedf21625a3d6847a3051b74b8c45844bdf719c486cb927c60440110c91c54e180acde6803109a26d4ad84a6c16c67855ea56a15d6fc0f6e8f3f0b96a0c
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T12DD51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE