2026-08-23_e9436a883906dc059ea3743bda5ff3a4_cobalt-strike_icedid_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_e9436a883906dc059ea3743bda5ff3a4_cobalt-strike_icedid_ryuk_satacom
Size 179KB
Sample260823-ve73bstsfx
SHA256 bfc102b7cef3c3a747119f9682518fbf2b475774b4e5e2b4258aa2edf5202b0b
MD5 e9436a883906dc059ea3743bda5ff3a4
SHA1 c4d5abcd89506d6dbcc08b64c35c1076cdc8779e
SHA512 6a2177830945094595085eaf7a91e96fb96126b08830ec021ae5eeb96a0a212612ceadc44db8ae4bb13b012dbf47d4b1fad78e144faa4c0a58a85f2cc23837f8
SSDEEP 3072:eZ+w8wK5Q8mZaZa4Ym9C06eWFm8dhy3pSgs7aObyVN5XlyN5i:P5wKWxmVDWFTdsEv+gf
TLSH
T1B5041646EEA038E5F3618F3B8705F5C4937A6865C710DADF06901E9E2E236D34DF8A91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_e9436a883906dc059ea3743bda5ff3a4_cobalt-strike_icedid_ryuk_satacom

File Explorer

2026-08-23_e9436a883906dc059ea3743bda5ff3a4_cobalt-strike_icedid_ryuk_satacom

.exe 179KB

2026-08-23_e9436a883906dc059ea3743bda5ff3a4_cobalt-strike_icedid_ryuk_satacom

IMPHASH c00bb297172d5fbc165dcfe75c6e0978
SHA256 bfc102b7cef3c3a747119f9682518fbf2b475774b4e5e2b4258aa2edf5202b0b
MD5 e9436a883906dc059ea3743bda5ff3a4
SHA1 c4d5abcd89506d6dbcc08b64c35c1076cdc8779e
SHA512 6a2177830945094595085eaf7a91e96fb96126b08830ec021ae5eeb96a0a212612ceadc44db8ae4bb13b012dbf47d4b1fad78e144faa4c0a58a85f2cc23837f8
SSDEEP 3072:eZ+w8wK5Q8mZaZa4Ym9C06eWFm8dhy3pSgs7aObyVN5XlyN5i:P5wKWxmVDWFTdsEv+gf
TLSH
T1B5041646EEA038E5F3618F3B8705F5C4937A6865C710DADF06901E9E2E236D34DF8A91
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

131072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW

shell32

CommandLineToArgvW

kernel32

CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.Npt2A08

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.firefly

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_e9436a883906dc059ea3743bda5ff3a4_cobalt-strike_icedid_ryuk_satacom

user32

shell32

kernel32

generic