2026-10-22_f5ea2da81c9aead7daa0ffc67e16f230_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_f5ea2da81c9aead7daa0ffc67e16f230_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom
Size 507KB
Sample261023-cdkarsbv5l
SHA256 41a7cba5a1604a2ee8ad9a6011b58bde6ec9fe68ba2c040cc1519cbabe792279
MD5 f5ea2da81c9aead7daa0ffc67e16f230
SHA1 3e0c084c6f0c1c9d93a37ba253abd868c2edd757
SHA512 abd7f2c25139fc69af3bb26b926221f0f361add4f8df6fe79bb5abf8e3151bf8ac5fe0d108bc3149e2cb76cb62efdf0959408753f8d106bc41cc0802f874ef5c
SSDEEP 6144:SsnJzJSOATNIO1iDVqYcKyPhVG17bctx769oWWJX30JSLqsozOQbS/E6:ScaOAP1iR8hVGYNWWJX30xO
TLSH
T187B48E94B3A947E8E076D1388A034542FB7178560B606AEF02E0927A3F776F55F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_f5ea2da81c9aead7daa0ffc67e16f230_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom

File Explorer

2026-10-22_f5ea2da81c9aead7daa0ffc67e16f230_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom

.exe 507KB

2026-10-22_f5ea2da81c9aead7daa0ffc67e16f230_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom

IMPHASH f74facb6ea3b952819009ecd20ae91ce
SHA256 41a7cba5a1604a2ee8ad9a6011b58bde6ec9fe68ba2c040cc1519cbabe792279
MD5 f5ea2da81c9aead7daa0ffc67e16f230
SHA1 3e0c084c6f0c1c9d93a37ba253abd868c2edd757
SHA512 abd7f2c25139fc69af3bb26b926221f0f361add4f8df6fe79bb5abf8e3151bf8ac5fe0d108bc3149e2cb76cb62efdf0959408753f8d106bc41cc0802f874ef5c
SSDEEP 6144:SsnJzJSOATNIO1iDVqYcKyPhVG17bctx769oWWJX30JSLqsozOQbS/E6:ScaOAP1iR8hVGYNWWJX30xO
TLSH
T187B48E94B3A947E8E076D1388A034542FB7178560B606AEF02E0927A3F776F55F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

207952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

protozero_descriptor_diff.exe.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileInformationByHandle GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

381KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_f5ea2da81c9aead7daa0ffc67e16f230_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom

kernel32

generic