General
- Target 2026-08-20_406be79616c4ad66bf55a059f2c14166_cobalt-strike_icedid_ryuk_satacom_vidar
- Size 941KB
- Sample260820-1w72jsbl5s
- SHA256 583d435398c3e67eda7ccfa6ce6e492b0b40686058f9ec929ee2eb80ff182ce3
- MD5 406be79616c4ad66bf55a059f2c14166
- SHA1 c270feb72daeef3e23e11564b0cdfee9636c3d7f
- SHA512 d754fc83432dd9223e120bacfef748bab80da55e415137c4797ee3b5356cf9e25241c49319e349b3c899954572e3a2f371fdfe125d0b5c399539d0c55a02ac37
- SSDEEP 12288:lNHC604alPkrxlAv6kcANLyu1pnboWTf9TLCUMmdEu8EfS66NbLnKgOVKVYnk8Dr:lNHCmkkrxwpLosVTLCUYu8sSFKDQHKr
- TLSH T1A6259E9FE8A741F9C05FD038C404A22769F93D5597608AAF46521B221E2FAF5FE34B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_406be79616c4ad66bf55a059f2c14166_cobalt-strike_icedid_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_406be79616c4ad66bf55a059f2c14166_cobalt-strike_icedid_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_406be79616c4ad66bf55a059f2c14166_cobalt-strike_icedid_ryuk_satacom_vidar
- Size 941KB
- SHA256 583d435398c3e67eda7ccfa6ce6e492b0b40686058f9ec929ee2eb80ff182ce3
- MD5 406be79616c4ad66bf55a059f2c14166
- SHA1 c270feb72daeef3e23e11564b0cdfee9636c3d7f
- SHA512 d754fc83432dd9223e120bacfef748bab80da55e415137c4797ee3b5356cf9e25241c49319e349b3c899954572e3a2f371fdfe125d0b5c399539d0c55a02ac37
- SSDEEP 12288:lNHC604alPkrxlAv6kcANLyu1pnboWTf9TLCUMmdEu8EfS66NbLnKgOVKVYnk8Dr:lNHCmkkrxwpLosVTLCUYu8sSFKDQHKr
- TLSH T1A6259E9FE8A741F9C05FD038C404A22769F93D5597608AAF46521B221E2FAF5FE34B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.