General
- Target 2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom
- Size 1.5MB
- Sample261023-e9m3mszw4n
- SHA256 315433446690278f0bc1afcf44bacdd6bf3d08e4e4ac7ee1b428cad5de22e0ec
- MD5 e81bb8aefcc7355f1552d73d2608af39
- SHA1 3f5a569cba487d1660f54ac65224cbbe07b554db
- SHA512 2f78afd6692b9462c95861b01edabd39d18691a83fe76f970c8884fd870352ffeebe4d24b66d2b4b9a0031bd9b7d863057c0acf0a1b05dc201d6e3cd5f0547c1
- SSDEEP 24576:umbXhZ18ytbW3LIXGhuqYYJL01b7ZR+YOUWj7yrtW:XhztkIetJNBU
- TLSH T1B665E1EBEA5B7EC5C433C53444266818E6917C310926CB9EDE631A17CC2A7C2AF35E35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom
- Size 1.5MB
- SHA256 315433446690278f0bc1afcf44bacdd6bf3d08e4e4ac7ee1b428cad5de22e0ec
- MD5 e81bb8aefcc7355f1552d73d2608af39
- SHA1 3f5a569cba487d1660f54ac65224cbbe07b554db
- SHA512 2f78afd6692b9462c95861b01edabd39d18691a83fe76f970c8884fd870352ffeebe4d24b66d2b4b9a0031bd9b7d863057c0acf0a1b05dc201d6e3cd5f0547c1
- SSDEEP 24576:umbXhZ18ytbW3LIXGhuqYYJL01b7ZR+YOUWj7yrtW:XhztkIetJNBU
- TLSH T1B665E1EBEA5B7EC5C433C53444266818E6917C310926CB9EDE631A17CC2A7C2AF35E35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Windows security bypass
-
Detects executables packed with unregistered version of .NET Reactor
-
Drops file in Drivers directory
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE
-
Windows security modification