General
- Target 2026-10-01_3661a5899da68f87b5403a071459cdfe_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
- Size 5.0MB
- Sample261002-vadb6ayhra
- SHA256 ddfc11ed1f42b6884e4d400e7803cec89d9fb789c35b92c8f338ce65f6108ac4
- MD5 3661a5899da68f87b5403a071459cdfe
- SHA1 cb22e1ee1aeeaf266b00b3fe9441e043da562ad4
- SHA512 cf7dfcd0feb67267bbfb91bd82baa7bb7b1701779e6ff45b8afdc68f6d8b742dff57ae4564f242ba75965774e04d1c30e28f465e5828a0560dcd1be2ed0e8957
- SSDEEP 49152:9iX15IJv/pKKCECpExtwDzS9MAvM6+kuXunb7Q97/tKJ+AaLLeNF7pLhCtIbHgql:hJ0Py9Mt/XuaK+YhC4N+k
- TLSH T1A6366B53A36511B8D46FC8B4CF29542296253C8A43F4A6FF26D876F51A32ED43B38F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_3661a5899da68f87b5403a071459cdfe_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_3661a5899da68f87b5403a071459cdfe_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
- Size 5.0MB
- SHA256 ddfc11ed1f42b6884e4d400e7803cec89d9fb789c35b92c8f338ce65f6108ac4
- MD5 3661a5899da68f87b5403a071459cdfe
- SHA1 cb22e1ee1aeeaf266b00b3fe9441e043da562ad4
- SHA512 cf7dfcd0feb67267bbfb91bd82baa7bb7b1701779e6ff45b8afdc68f6d8b742dff57ae4564f242ba75965774e04d1c30e28f465e5828a0560dcd1be2ed0e8957
- SSDEEP 49152:9iX15IJv/pKKCECpExtwDzS9MAvM6+kuXunb7Q97/tKJ+AaLLeNF7pLhCtIbHgql:hJ0Py9Mt/XuaK+YhC4N+k
- TLSH T1A6366B53A36511B8D46FC8B4CF29542296253C8A43F4A6FF26D876F51A32ED43B38F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1