General
- Target 2026-07-01_ad4aa0933b87b0bb7a2d686c7fe49671_cobalt-strike_icedid_ryuk_satacom_vidar
- Size 11.7MB
- Sample260701-jvycaahv5n
- SHA256 0e19d7e07dad0f4a0960341e4dc1a8e70879271f765cca1b151a8507510c0352
- MD5 ad4aa0933b87b0bb7a2d686c7fe49671
- SHA1 92e2093028e0997232e082a74338fa4939619d4e
- SHA512 c1d0aa47113adfd93c85605eaeacf1a274e81a7c46f3c5201fa84d8a58922c4e17f832dc28db27fb7d2cc566d9d46b8d18687be7dee2ed9f64d3bb728f2c87b1
- SSDEEP 196608:S38fjR9YayCSpym1CiigWasGBbaE4tyx9zeFSYGOZ3oNqJ9Ad7E26uzQTR/:RR5yCSpym1CiigCkaE4E9zYO699/
- TLSH T192C62B479ED69C7A8020AB727E5910F1DE265C61FFA9CDC9D1E2B189D1710C8FB2428F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_ad4aa0933b87b0bb7a2d686c7fe49671_cobalt-strike_icedid_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_ad4aa0933b87b0bb7a2d686c7fe49671_cobalt-strike_icedid_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_ad4aa0933b87b0bb7a2d686c7fe49671_cobalt-strike_icedid_ryuk_satacom_vidar
- Size 11.7MB
- SHA256 0e19d7e07dad0f4a0960341e4dc1a8e70879271f765cca1b151a8507510c0352
- MD5 ad4aa0933b87b0bb7a2d686c7fe49671
- SHA1 92e2093028e0997232e082a74338fa4939619d4e
- SHA512 c1d0aa47113adfd93c85605eaeacf1a274e81a7c46f3c5201fa84d8a58922c4e17f832dc28db27fb7d2cc566d9d46b8d18687be7dee2ed9f64d3bb728f2c87b1
- SSDEEP 196608:S38fjR9YayCSpym1CiigWasGBbaE4tyx9zeFSYGOZ3oNqJ9Ad7E26uzQTR/:RR5yCSpym1CiigCkaE4E9zYO699/
- TLSH T192C62B479ED69C7A8020AB727E5910F1DE265C61FFA9CDC9D1E2B189D1710C8FB2428F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.