General
- Target 2026-10-19_cb4f84b4047f03a18cdeab50de8b3419_cobalt-strike_icedid_ryuk_satacom
- Size 1.1MB
- Sample261020-lrx88aah96
- SHA256 de50565fc6aa3d815865c4b08b0861d12015a665ab16513087ee0515054b7f0b
- MD5 cb4f84b4047f03a18cdeab50de8b3419
- SHA1 551f1d420b52a4c86ffd4e8f270b31f05dd54617
- SHA512 8bdbd83e8ec1a7c3423b2fed8d15b0c381a764648f940b4f3e0930b956998d1d0d6af125db7e6eaadc3083e9e8e7140b60c108e77f063dbed1a6bb7eb3446843
- SSDEEP 12288:UOR18ipxCYgpqFF8IBFl68K5FfdcDQZ2fxQJh/V+z1tB28D6hAEZxn3f763de2sn:t6Zho/JwdPZgQJfqt88sznz6tJDa
- TLSH T14145BD52BF58CEF8F8DE55774A2C43359D6CF4181BD0D5AA821CA66C3E3A183CAF9205
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_cb4f84b4047f03a18cdeab50de8b3419_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_cb4f84b4047f03a18cdeab50de8b3419_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_cb4f84b4047f03a18cdeab50de8b3419_cobalt-strike_icedid_ryuk_satacom
- Size 1.1MB
- SHA256 de50565fc6aa3d815865c4b08b0861d12015a665ab16513087ee0515054b7f0b
- MD5 cb4f84b4047f03a18cdeab50de8b3419
- SHA1 551f1d420b52a4c86ffd4e8f270b31f05dd54617
- SHA512 8bdbd83e8ec1a7c3423b2fed8d15b0c381a764648f940b4f3e0930b956998d1d0d6af125db7e6eaadc3083e9e8e7140b60c108e77f063dbed1a6bb7eb3446843
- SSDEEP 12288:UOR18ipxCYgpqFF8IBFl68K5FfdcDQZ2fxQJh/V+z1tB28D6hAEZxn3f763de2sn:t6Zho/JwdPZgQJfqt88sznz6tJDa
- TLSH T14145BD52BF58CEF8F8DE55774A2C43359D6CF4181BD0D5AA821CA66C3E3A183CAF9205
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext