2026-10-10_0615cce17dd75979b077c7dc9bd2bd46_cobalt-strike_icedid_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_0615cce17dd75979b077c7dc9bd2bd46_cobalt-strike_icedid_ryuk_satacom_vidar
Size 4.4MB
Sample261011-2bf8rsaa87
SHA256 fe9e58905a87474945821a3238348747f7a7ce8834585d1f4f55071955d0bf02
MD5 0615cce17dd75979b077c7dc9bd2bd46
SHA1 65ca072382e41d9633f814840b026ea96887b083
SHA512 93f7732903aff66ee1de21f2d5b8ea99decd26e0311e9bc8d6d3797d9f6304ff3fcb461cf33b6a3153b0e0e91ac87678b6dd6ab71883df451f7c24f8f50922b9
SSDEEP 49152:2PBiTd0dKrvR1t1dobkYjzjQtDTD8b7HS4ZSTRxBRuTsbamLa/U9J9xR2C1TQ:2OhY/jsI3yHnJh1T
TLSH
T11626D5502F5A9A3AC5DBC030D2564AB1493635DA0B39FAFF848097783E39AF41F7D258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_0615cce17dd75979b077c7dc9bd2bd46_cobalt-strike_icedid_ryuk_satacom_vidar

File Explorer

2026-10-10_0615cce17dd75979b077c7dc9bd2bd46_cobalt-strike_icedid_ryuk_satacom_vidar

.exe 4.4MB

2026-10-10_0615cce17dd75979b077c7dc9bd2bd46_cobalt-strike_icedid_ryuk_satacom_vidar

IMPHASH 6b0fa2910d6bdab14b0187f1cea28880
SHA256 fe9e58905a87474945821a3238348747f7a7ce8834585d1f4f55071955d0bf02
MD5 0615cce17dd75979b077c7dc9bd2bd46
SHA1 65ca072382e41d9633f814840b026ea96887b083
SHA512 93f7732903aff66ee1de21f2d5b8ea99decd26e0311e9bc8d6d3797d9f6304ff3fcb461cf33b6a3153b0e0e91ac87678b6dd6ab71883df451f7c24f8f50922b9
SSDEEP 49152:2PBiTd0dKrvR1t1dobkYjzjQtDTD8b7HS4ZSTRxBRuTsbamLa/U9J9xR2C1TQ:2OhY/jsI3yHnJh1T
TLSH
T11626D5502F5A9A3AC5DBC030D2564AB1493635DA0B39FAFF848097783E39AF41F7D258
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2949360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cxxbridge.exe.pdb

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CreateFileW CreateMutexA DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile lstrlenW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

285KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

290B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_0615cce17dd75979b077c7dc9bd2bd46_cobalt-strike_icedid_ryuk_satacom_vidar

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

generic