General
- Target 2026-10-14_f31389b478f5c907ea54fb0740d7158d_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- Sample261014-kmvrvsav4t
- SHA256 e069c8881825447bc67f4968f7126e9a0aeaca716ea163b1260df104503df60f
- MD5 f31389b478f5c907ea54fb0740d7158d
- SHA1 7ab4968f7131a29ac18617f7fbdf5c82b7c7e79e
- SHA512 665edc0624a8fab0ecdecfe186a9aa96b17f9119bd8ccf671fcf4cd7d49d9ffcb5ae04162f3f8bf6aa8b9d8cf0d46dc3b8183a5a561bc8fbcc065ac97c5414f2
- SSDEEP 24576:Aso/MdkzESv4wze2SXd/Vf8G74NHKwf5bSHe:xUM6QSvji2IyG745KySH
- TLSH T182359D0DFF90BCB1F155B8784541DB1299EF783636E396FA038C46281A126AC4BFD64E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-14_f31389b478f5c907ea54fb0740d7158d_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_f31389b478f5c907ea54fb0740d7158d_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-14_f31389b478f5c907ea54fb0740d7158d_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- SHA256 e069c8881825447bc67f4968f7126e9a0aeaca716ea163b1260df104503df60f
- MD5 f31389b478f5c907ea54fb0740d7158d
- SHA1 7ab4968f7131a29ac18617f7fbdf5c82b7c7e79e
- SHA512 665edc0624a8fab0ecdecfe186a9aa96b17f9119bd8ccf671fcf4cd7d49d9ffcb5ae04162f3f8bf6aa8b9d8cf0d46dc3b8183a5a561bc8fbcc065ac97c5414f2
- SSDEEP 24576:Aso/MdkzESv4wze2SXd/Vf8G74NHKwf5bSHe:xUM6QSvji2IyG745KySH
- TLSH T182359D0DFF90BCB1F155B8784541DB1299EF783636E396FA038C46281A126AC4BFD64E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext