General
- Target 2026-11-10_ee9e4a22b7d047cf200d6d6d0ea2ae9f_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.7MB
- Sample261110-ffpj2sch73
- SHA256 ce2f8b0bb4bfa85594bf35c52b5541dadc88ee75d9ef0c8a7a3d720a0262b5c9
- MD5 ee9e4a22b7d047cf200d6d6d0ea2ae9f
- SHA1 2dbf34244c3857799f3109a43d27a21955dd0814
- SHA512 2b39927300246c19c84ba7df91ae6612a04d3a272feb8866b065ea43acc25414557545045dc5c5314f4db6a38c2bd89b0f1b997e6dc4275ece1a049f5083b0f1
- SSDEEP 49152:kDjlabwz9e8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7:0qwFaZ9XANzQxNEGYTy/CRxMkLC4FQ4x
- TLSH T14BD51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-10_ee9e4a22b7d047cf200d6d6d0ea2ae9f_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-10_ee9e4a22b7d047cf200d6d6d0ea2ae9f_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 2.7MB
- SHA256 ce2f8b0bb4bfa85594bf35c52b5541dadc88ee75d9ef0c8a7a3d720a0262b5c9
- MD5 ee9e4a22b7d047cf200d6d6d0ea2ae9f
- SHA1 2dbf34244c3857799f3109a43d27a21955dd0814
- SHA512 2b39927300246c19c84ba7df91ae6612a04d3a272feb8866b065ea43acc25414557545045dc5c5314f4db6a38c2bd89b0f1b997e6dc4275ece1a049f5083b0f1
- SSDEEP 49152:kDjlabwz9e8aWgT9XAR9NVhQxNEGAootTySME93GOeyMkiSJJCxuFQ4pIKPZ7:0qwFaZ9XANzQxNEGYTy/CRxMkLC4FQ4x
- TLSH T14BD51209E7E908F9D077E538D5668902F3BA7C5D0761EB9F23A0166A1F67390CE39312
- MD5 SHA1 SHA512 SSDEEP TLSH
XMRig Miner payload
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE