General
- Target 2026-10-22_b82c9decf945fc3215963df353f24a3e_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- Sample261023-3as2ls1vds
- SHA256 3e7962c020aac3154a9466b77c3c8263265fe57f31eab30a137ddc74a847ae61
- MD5 b82c9decf945fc3215963df353f24a3e
- SHA1 9755a734f9b3fbda1209a13a0b55ff87d8f605f8
- SHA512 d8dabbf57406ac8bcfbabf1e9482d7be20b63d14129ac9cb449e875c41b8381379f997bd95bd25b5fe867ba2311ee4350ff28885a13685605e79b1a54a62b637
- SSDEEP 24576:MgmU91ol1IUCN015HzO1RpJSyiN5y3EA7I:MgmU3oU3S1Ifziyt
- TLSH T11435BDC1B7960AB5E41AB0344D430CCEDDE12B03F6E07DAAD25F121A1AEF59D4AF961C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_b82c9decf945fc3215963df353f24a3e_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_b82c9decf945fc3215963df353f24a3e_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_b82c9decf945fc3215963df353f24a3e_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- SHA256 3e7962c020aac3154a9466b77c3c8263265fe57f31eab30a137ddc74a847ae61
- MD5 b82c9decf945fc3215963df353f24a3e
- SHA1 9755a734f9b3fbda1209a13a0b55ff87d8f605f8
- SHA512 d8dabbf57406ac8bcfbabf1e9482d7be20b63d14129ac9cb449e875c41b8381379f997bd95bd25b5fe867ba2311ee4350ff28885a13685605e79b1a54a62b637
- SSDEEP 24576:MgmU91ol1IUCN015HzO1RpJSyiN5y3EA7I:MgmU3oU3S1Ifziyt
- TLSH T11435BDC1B7960AB5E41AB0344D430CCEDDE12B03F6E07DAAD25F121A1AEF59D4AF961C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext