2026-03-18_2bdb691948658c7ab73e8bcd51cc8250_cobalt-strike_icedid_ryuk_satacom_stealc

General

Target
2026-03-18_2bdb691948658c7ab73e8bcd51cc8250_cobalt-strike_icedid_ryuk_satacom_stealc
Size 2.6MB
Sample260319-xypffacv4p
SHA256 2e2a5ab47233eec05f117731de4a64c0f3707328578407df795c07d4543fa566
MD5 2bdb691948658c7ab73e8bcd51cc8250
SHA1 996484fadc43307d3dca5df33e5f98bfed999c79
SHA512 6d6bc23e6bf766a5bd79b1ebfc9b5169405028c4b32768c6df9ef68b50bd145b1f1ba96c7ef17222bb2314c292f28ea309443423448b9db7e5fa1bcd5183479c
SSDEEP 49152:IzeyfUeBaXsv2fft50iG5LP/Klhl/l/5zpxzqI6bOq/EUQ/lFTjN4:IxfUmyC2fF5ZsLP/kl/lh9BqI6LmLm
TLSH
T15CC52377EAA571F9E15F4D3088925881EF627C62AB11EFEB53440E392D362D08F79B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-18_2bdb691948658c7ab73e8bcd51cc8250_cobalt-strike_icedid_ryuk_satacom_stealc

File Explorer

2026-03-18_2bdb691948658c7ab73e8bcd51cc8250_cobalt-strike_icedid_ryuk_satacom_stealc

.exe 2.6MB

2026-03-18_2bdb691948658c7ab73e8bcd51cc8250_cobalt-strike_icedid_ryuk_satacom_stealc

IMPHASH 6d37d8d211e2046ee417febe92e137de
SHA256 2e2a5ab47233eec05f117731de4a64c0f3707328578407df795c07d4543fa566
MD5 2bdb691948658c7ab73e8bcd51cc8250
SHA1 996484fadc43307d3dca5df33e5f98bfed999c79
SHA512 6d6bc23e6bf766a5bd79b1ebfc9b5169405028c4b32768c6df9ef68b50bd145b1f1ba96c7ef17222bb2314c292f28ea309443423448b9db7e5fa1bcd5183479c
SSDEEP 49152:IzeyfUeBaXsv2fft50iG5LP/Klhl/l/5zpxzqI6bOq/EUQ/lFTjN4:IxfUmyC2fF5ZsLP/kl/lh9BqI6LmLm
TLSH
T15CC52377EAA571F9E15F4D3088925881EF627C62AB11EFEB53440E392D362D08F79B01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

29804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileW CreateFileW CreateMutexW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar QueryPerformanceCounter RaiseException ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte Wow64GetThreadContext Wow64SetThreadContext WriteConsoleW WriteFile

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.txts

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-18_2bdb691948658c7ab73e8bcd51cc8250_cobalt-strike_icedid_ryuk_satacom_stealc

kernel32

generic