General
- Target 2026-08-05_405632cb6225f5a9c4bf33df18fa1024_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm
- Size 377KB
- Sample260805-z9bd3aea97
- SHA256 ab45cb39b5b1eca7e9a474817c7b85abc0ab8e32bb5902c0fedaa6e5a120ba10
- MD5 405632cb6225f5a9c4bf33df18fa1024
- SHA1 61991e0b3aa1e2fc85ea84e94dc5ada661432f30
- SHA512 bda4a65ea0b7602f71d34320ed8691c6d83e6df060d1e26f22556b5241192aef64cba5b77e2e315b6629d120cb77f62f7520d901a6e6f689625c9a3ec2f40aa7
- SSDEEP 6144:p+lYnA0zeWsDi5eJHQ8kV3f+RysMFZzN/E/msxrtE8sNrw8:SYyDi5eJQ7uysMFZzN/E/msxBm1d
- TLSH T160847C16F79508FDD5ABC57489A245469A357C9F0B71EADF07C8422A2F237F08E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-05_405632cb6225f5a9c4bf33df18fa1024_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_405632cb6225f5a9c4bf33df18fa1024_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_405632cb6225f5a9c4bf33df18fa1024_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm
- Size 377KB
- SHA256 ab45cb39b5b1eca7e9a474817c7b85abc0ab8e32bb5902c0fedaa6e5a120ba10
- MD5 405632cb6225f5a9c4bf33df18fa1024
- SHA1 61991e0b3aa1e2fc85ea84e94dc5ada661432f30
- SHA512 bda4a65ea0b7602f71d34320ed8691c6d83e6df060d1e26f22556b5241192aef64cba5b77e2e315b6629d120cb77f62f7520d901a6e6f689625c9a3ec2f40aa7
- SSDEEP 6144:p+lYnA0zeWsDi5eJHQ8kV3f+RysMFZzN/E/msxrtE8sNrw8:SYyDi5eJQ7uysMFZzN/E/msxBm1d
- TLSH T160847C16F79508FDD5ABC57489A245469A357C9F0B71EADF07C8422A2F237F08E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Modifies system executable filetype association