General
- Target 2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom
- Size 3.6MB
- Sample261006-tsbeva1s8j
- SHA256 5f7f807466699da3ca55646bf53dc41abbfa35f6dec54d581079198ceaeefab4
- MD5 b95fafe61dfc0c250ff60197c4fba4c5
- SHA1 9613076952f50d5d329b1fa4c6dc23d4f0e58142
- SHA512 77cb186cb0c66b2ec1fad18b82d11f0a9930d4c7c2ccf82831aec8bbda23278f6de4b0cf6e034431b6f4850a80148052db02580e25f4847da47d52194f2ebc95
- SSDEEP 49152:VurJ+ffbhvJGjQpZc+U7cpHnfBZ6BSH6F/mV8x4x8EVep:GgLRk4GSI/mKix8EVy
- TLSH T173065B23F2E600D8C05DD1759B4A8332A6E1BCA58F70A3DF465176161FB6ED06B3E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom
- Size 3.6MB
- SHA256 5f7f807466699da3ca55646bf53dc41abbfa35f6dec54d581079198ceaeefab4
- MD5 b95fafe61dfc0c250ff60197c4fba4c5
- SHA1 9613076952f50d5d329b1fa4c6dc23d4f0e58142
- SHA512 77cb186cb0c66b2ec1fad18b82d11f0a9930d4c7c2ccf82831aec8bbda23278f6de4b0cf6e034431b6f4850a80148052db02580e25f4847da47d52194f2ebc95
- SSDEEP 49152:VurJ+ffbhvJGjQpZc+U7cpHnfBZ6BSH6F/mV8x4x8EVep:GgLRk4GSI/mKix8EVy
- TLSH T173065B23F2E600D8C05DD1759B4A8332A6E1BCA58F70A3DF465176161FB6ED06B3E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1