2026-09-20_8d670651c3bdd8956bd9eca38254e7f7_cobalt-strike_icedid_ryuk_satacom_vidar

General

Target
2026-09-20_8d670651c3bdd8956bd9eca38254e7f7_cobalt-strike_icedid_ryuk_satacom_vidar
Size 688KB
Sample260920-xdbnvack61
SHA256 8a068f2c53d5b3e98fbfc656e83894650126829b800085747dc784b496de9800
MD5 8d670651c3bdd8956bd9eca38254e7f7
SHA1 484749c0a4d8f53856cd9dacd8d63440e77a8982
SHA512 8a3123e1b1d89362bfc71b6c54fa09d94552cf464561a377ad663df72b862a3505bec61f2c671a00dcb18522a45e4ff8ac44310ac739bc2a49606b1487178391
SSDEEP 12288:YGUbUiDSBJ45+xAQbkV6FSzLo8ZKUbUiDSBJ45+xAQbkV6FSzLo8UFnNzQD9FVk6:YGUbUiDSBJ45+xAQbkV6FSzLo8ZKUbUE
TLSH
T160E41965D933FA09C74B243D28449C5FC5A72A289DF18B7EC350CB29494BBC05B5F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-20_8d670651c3bdd8956bd9eca38254e7f7_cobalt-strike_icedid_ryuk_satacom_vidar

File Explorer

2026-09-20_8d670651c3bdd8956bd9eca38254e7f7_cobalt-strike_icedid_ryuk_satacom_vidar

.exe 688KB

2026-09-20_8d670651c3bdd8956bd9eca38254e7f7_cobalt-strike_icedid_ryuk_satacom_vidar

IMPHASH f0dc8f90de7be7a0d5f0f3691a8e22bc
SHA256 8a068f2c53d5b3e98fbfc656e83894650126829b800085747dc784b496de9800
MD5 8d670651c3bdd8956bd9eca38254e7f7
SHA1 484749c0a4d8f53856cd9dacd8d63440e77a8982
SHA512 8a3123e1b1d89362bfc71b6c54fa09d94552cf464561a377ad663df72b862a3505bec61f2c671a00dcb18522a45e4ff8ac44310ac739bc2a49606b1487178391
SSDEEP 12288:YGUbUiDSBJ45+xAQbkV6FSzLo8ZKUbUiDSBJ45+xAQbkV6FSzLo8UFnNzQD9FVk6:YGUbUiDSBJ45+xAQbkV6FSzLo8ZKUbUE
TLSH
T160E41965D933FA09C74B243D28449C5FC5A72A289DF18B7EC350CB29494BBC05B5F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

143060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CompareStringW CreateFileA CreateFileW DeleteCriticalSection EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WideCharToMultiByte WriteConsoleW WriteFile

user32

CharUpperA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-20_8d670651c3bdd8956bd9eca38254e7f7_cobalt-strike_icedid_ryuk_satacom_vidar

kernel32

user32

generic