General
- Target 2026-09-09_bf7d5fc5448b487c650126f4e90d892e_cobalt-strike_coinminer_elex_icedid_njrat_vidar
- Size 720KB
- Sample260909-pvykyawbmd
- SHA256 a1af7eee631cc009eee5249ee9bfd62b83873268fe91f3399d48cdc078ecbae6
- MD5 bf7d5fc5448b487c650126f4e90d892e
- SHA1 92236dfe45d55571f188c23e70caf956c552794b
- SHA512 f48f35f2ee89c6779a45f5916158cd9730455f5b85ab679382b85dc351f8b2202730f3599691835d0a0ef95c6c6fb42d01ad79d4b8fa4b86b512637e1808157b
- SSDEEP 12288:sW7Kx6IZipJxlH5BtW5fqZSl0E7KpivZolyuEPBX:j2NZibxlm4M0E7K8u1EJ
- TLSH T10FF47E5662A903FCE47BC13889429902E6B93C4607B09ADF13A076771FB77D19E3BB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-09_bf7d5fc5448b487c650126f4e90d892e_cobalt-strike_coinminer_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_bf7d5fc5448b487c650126f4e90d892e_cobalt-strike_coinminer_elex_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-09_bf7d5fc5448b487c650126f4e90d892e_cobalt-strike_coinminer_elex_icedid_njrat_vidar
- Size 720KB
- SHA256 a1af7eee631cc009eee5249ee9bfd62b83873268fe91f3399d48cdc078ecbae6
- MD5 bf7d5fc5448b487c650126f4e90d892e
- SHA1 92236dfe45d55571f188c23e70caf956c552794b
- SHA512 f48f35f2ee89c6779a45f5916158cd9730455f5b85ab679382b85dc351f8b2202730f3599691835d0a0ef95c6c6fb42d01ad79d4b8fa4b86b512637e1808157b
- SSDEEP 12288:sW7Kx6IZipJxlH5BtW5fqZSl0E7KpivZolyuEPBX:j2NZibxlm4M0E7K8u1EJ
- TLSH T10FF47E5662A903FCE47BC13889429902E6B93C4607B09ADF13A076771FB77D19E3BB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application