2026-10-08_6a1c599b4adf0449f187b1c223ed57a5_cobalt-strike_icedid_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_6a1c599b4adf0449f187b1c223ed57a5_cobalt-strike_icedid_ryuk_satacom
Size 31.0MB
Sample261009-pvsppaex5r
SHA256 3e7d6e0ddf3224ee953ce518dc5b1237377d70cd0258ee1ec0ade39b56966029
MD5 6a1c599b4adf0449f187b1c223ed57a5
SHA1 ce49ee7a6a7e2c9efa8253b04e06f7e0f31721a6
SHA512 e1533cc928110c3e0c95c59a23442ef0cf586056dd84bc858714ea5eed3eeecf313a0821922e33b48ec8c77bf5788b9f00e167016af1de77aab7b5048c7ce172
SSDEEP 786432:bNdMwGzi/wgDNF/Te7JhIs5z7/y1T5YW5VDEs4wPwLy:xdpF/tSf7wT5YwtEs5PEy
TLSH
T120673307FB9FC1AACF97C874CA62247AC8713C05DA95D2BF5599C7292C122CC49366F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_6a1c599b4adf0449f187b1c223ed57a5_cobalt-strike_icedid_ryuk_satacom

File Explorer

2026-10-08_6a1c599b4adf0449f187b1c223ed57a5_cobalt-strike_icedid_ryuk_satacom

.exe 31.0MB

2026-10-08_6a1c599b4adf0449f187b1c223ed57a5_cobalt-strike_icedid_ryuk_satacom

IMPHASH e8651af884755a99888495c115c825d9
SHA256 3e7d6e0ddf3224ee953ce518dc5b1237377d70cd0258ee1ec0ade39b56966029
MD5 6a1c599b4adf0449f187b1c223ed57a5
SHA1 ce49ee7a6a7e2c9efa8253b04e06f7e0f31721a6
SHA512 e1533cc928110c3e0c95c59a23442ef0cf586056dd84bc858714ea5eed3eeecf313a0821922e33b48ec8c77bf5788b9f00e167016af1de77aab7b5048c7ce172
SSDEEP 786432:bNdMwGzi/wgDNF/Te7JhIs5z7/y1T5YW5VDEs4wPwLy:xdpF/tSf7wT5YwtEs5PEy
TLSH
T120673307FB9FC1AACF97C874CA62247AC8713C05DA95D2BF5599C7292C122CC49366F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tuplemix.pdb

user32

BeginPaint EndPaint FillRect GetActiveWindow GetCapture GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetInputState GetMessageExtraInfo GetMessagePos GetMessageTime GetShellWindow InvalidateRect UpdateWindow

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetActiveProcessorCount GetActiveProcessorGroupCount GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLogicalDriveStringsW GetLogicalDrives GetMaximumProcessorCount GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessHeaps GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemInfo GetSystemTimeAsFileTime GetThreadLocale GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersion HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

gdi32

Rectangle TextOutW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

575KB

Virtual Size

574KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

209B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_6a1c599b4adf0449f187b1c223ed57a5_cobalt-strike_icedid_ryuk_satacom

user32

kernel32

gdi32

api-ms-win-core-synch-l1-2-0

ntdll

generic