General
- Target 2026-10-22_e966e98d645ade3acbd8a410b2564cef_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- Sample261023-e24qeswvfw
- SHA256 c822b6fadad9d30d3eec3b7f13371031237d3a58412d82b3967fd2e724d8d153
- MD5 e966e98d645ade3acbd8a410b2564cef
- SHA1 06eed70b6135014bb508dc59b5f55bc8f3e3506b
- SHA512 55fbb4d580587e2598d0fe16bb2a7030f20e986ccd11bb43e7d55bebe9245dfe4300f91dbeaa2464ea84dbd03e0feeb7ec2a6ffc9372028365d7ca82d33d238b
- SSDEEP 12288:HTNshu7HzKBql2Ov9TJx4kgCn8P/SiKkygjeJ7gxmAF4jUxRuQ2IDoNGmFM+UrJW:f7/R10JxzjyimAmjcRuRIDz+ER/8
- TLSH T170353C0D6B560DFCF6EBF137CA938111F6244518E6E8AE07833D972D1DD422729F8AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_e966e98d645ade3acbd8a410b2564cef_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_e966e98d645ade3acbd8a410b2564cef_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- SHA256 c822b6fadad9d30d3eec3b7f13371031237d3a58412d82b3967fd2e724d8d153
- MD5 e966e98d645ade3acbd8a410b2564cef
- SHA1 06eed70b6135014bb508dc59b5f55bc8f3e3506b
- SHA512 55fbb4d580587e2598d0fe16bb2a7030f20e986ccd11bb43e7d55bebe9245dfe4300f91dbeaa2464ea84dbd03e0feeb7ec2a6ffc9372028365d7ca82d33d238b
- SSDEEP 12288:HTNshu7HzKBql2Ov9TJx4kgCn8P/SiKkygjeJ7gxmAF4jUxRuQ2IDoNGmFM+UrJW:f7/R10JxzjyimAmjcRuRIDz+ER/8
- TLSH T170353C0D6B560DFCF6EBF137CA938111F6244518E6E8AE07833D972D1DD422729F8AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext