General
- Target 2026-09-22_b17ed62cff8b09fb0e515e2d13f2a52a_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.7MB
- Sample260922-wmabpscb44
- SHA256 7d7940266d8a49fe42cc6df505f532d43839c4178fe89e8730cc7ce98f4caaad
- MD5 b17ed62cff8b09fb0e515e2d13f2a52a
- SHA1 26715b613759a8d9c74229e14abf3f4ae1c423d3
- SHA512 14e519060c02e5000265da5195897adbe208f9207646d8bd038b75a52773cdecc495dcc86a42dcfc75a7784049c56ede310fabd0857a9ee8dd9b1a4db9f3f78f
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1C2D51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-22_b17ed62cff8b09fb0e515e2d13f2a52a_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-22_b17ed62cff8b09fb0e515e2d13f2a52a_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.7MB
- SHA256 7d7940266d8a49fe42cc6df505f532d43839c4178fe89e8730cc7ce98f4caaad
- MD5 b17ed62cff8b09fb0e515e2d13f2a52a
- SHA1 26715b613759a8d9c74229e14abf3f4ae1c423d3
- SHA512 14e519060c02e5000265da5195897adbe208f9207646d8bd038b75a52773cdecc495dcc86a42dcfc75a7784049c56ede310fabd0857a9ee8dd9b1a4db9f3f78f
- SSDEEP 49152:kDjlabwz9EetuYs9o9H+LtfhKDezZyIP66TR+3Ql/GA/6kVtbP/imqGM8:0qwZmogLRhK+ZlPJXlVd6m3M
- TLSH T1C2D51209E3E905F8E4B7EA78C9660907F7793C4943218B8F13E5556A2F57390DE3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE