2026-07-15_7dd22786ad20b5ddff4301e3ebf5933f_cobalt-strike_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_7dd22786ad20b5ddff4301e3ebf5933f_cobalt-strike_icedid_njrat_ryuk_satacom
Size 357KB
Sample260715-c24djscy71
SHA256 b85f92f0c0459b47017d97899787df63f4c33e71033979b4ed93d9470e3f2776
MD5 7dd22786ad20b5ddff4301e3ebf5933f
SHA1 31d4bf5aa2d1a045eee317b5ca4bd6a71011beff
SHA512 9c17f3563a34f399e1842768837d91c30cad8a739fbd8c343149696f501c94bcae0b29cf79bdbe8bd8fdeb99305e83bf8e62afb02b1453ad7d95601690dcaf22
SSDEEP 6144:nOX/FB+0VT5wIEjkv9Ws5MRm2RM7E3WQoyAlJIhHxnoxSfv:OX/FBtVT5pEiKm2R6EmQDAlJIhHFok
TLSH
T171748D28C3590899E69201BE6C504780B475BE7223754BE753F4CB253B175F0CABBBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_7dd22786ad20b5ddff4301e3ebf5933f_cobalt-strike_icedid_njrat_ryuk_satacom

File Explorer

2026-07-15_7dd22786ad20b5ddff4301e3ebf5933f_cobalt-strike_icedid_njrat_ryuk_satacom

.exe 357KB

2026-07-15_7dd22786ad20b5ddff4301e3ebf5933f_cobalt-strike_icedid_njrat_ryuk_satacom

IMPHASH 0b2893fd28a86effa64da917b0688931
SHA256 b85f92f0c0459b47017d97899787df63f4c33e71033979b4ed93d9470e3f2776
MD5 7dd22786ad20b5ddff4301e3ebf5933f
SHA1 31d4bf5aa2d1a045eee317b5ca4bd6a71011beff
SHA512 9c17f3563a34f399e1842768837d91c30cad8a739fbd8c343149696f501c94bcae0b29cf79bdbe8bd8fdeb99305e83bf8e62afb02b1453ad7d95601690dcaf22
SSDEEP 6144:nOX/FB+0VT5wIEjkv9Ws5MRm2RM7E3WQoyAlJIhHxnoxSfv:OX/FBtVT5pEiKm2R6EmQDAlJIhHFok
TLSH
T171748D28C3590899E69201BE6C504780B475BE7223754BE753F4CB253B175F0CABBBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

136504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CompareStringW CreateFileA CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentStringsW GetFileAttributesA GetFileAttributesExA GetFileSizeEx GetFileType GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pad

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_7dd22786ad20b5ddff4301e3ebf5933f_cobalt-strike_icedid_njrat_ryuk_satacom

kernel32

generic