General
- Target 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk
- Size 170KB
- Sample260820-ab93asbr4t
- SHA256 38a95a8479051a511cdfec97d7ab88ebe116ffc1a084a54888c54f1a0ac2e8a3
- MD5 9f6d6a998f90dfc89761dcbf150fc2bc
- SHA1 d0db7ea14a495468f77bccfb4526384d63aca5ba
- SHA512 140f17a4f1292819ac6de38c8afb3a5abd9057f5e9f663176f1117f5d2031b98737fa5167f8804f71598465d72d340b25232697a9ec813e1f00af243334191ff
- SSDEEP 3072:JmXlsXCel7r9+vDpf1flr+Rf5U1xbff5eLRJyxjEbCNt+FdjsZLG4T4yufbPlEGD:JYM3lXSptYRyICNt+njsc42BHwnPiaQ
- TLSH T10F040744F29E50E8E0768138A5A24751BAF37C1507645FFF06A44F6AAEE3AC07D3BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk
- Size 170KB
- SHA256 38a95a8479051a511cdfec97d7ab88ebe116ffc1a084a54888c54f1a0ac2e8a3
- MD5 9f6d6a998f90dfc89761dcbf150fc2bc
- SHA1 d0db7ea14a495468f77bccfb4526384d63aca5ba
- SHA512 140f17a4f1292819ac6de38c8afb3a5abd9057f5e9f663176f1117f5d2031b98737fa5167f8804f71598465d72d340b25232697a9ec813e1f00af243334191ff
- SSDEEP 3072:JmXlsXCel7r9+vDpf1flr+Rf5U1xbff5eLRJyxjEbCNt+FdjsZLG4T4yufbPlEGD:JYM3lXSptYRyICNt+njsc42BHwnPiaQ
- TLSH T10F040744F29E50E8E0768138A5A24751BAF37C1507645FFF06A44F6AAEE3AC07D3BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE