General
- Target 2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom
- Size 1.2MB
- Sample261024-1ec5vaes9m
- SHA256 22249fabdf1cb0c3a41a86f16d93c475e2c21e6df0b7c44c8acba6b416d4d065
- MD5 106663a507e1b7b4586fea07fc5daf60
- SHA1 e83e32591ba1079262bc3df3b7a961fb53ad38aa
- SHA512 2bf0eed6119e1f759c3ba451af69c5b0e5d429e1f53e518a2cae7700f45681b72772d232ba1d06ac01dc59c36c4331fee36465f149abc377be4487abb7e1859d
- SSDEEP 24576:6lrcUsXqkQOC1aO0OHZK22Pfz+740hgaMX7gID:6hrOCPbHV7VIHD
- TLSH T16045BE52BF971DF9F46581314716496EBDD378320AF125BB12CCE70B0E2A6909BFAE10
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom
- Size 1.2MB
- SHA256 22249fabdf1cb0c3a41a86f16d93c475e2c21e6df0b7c44c8acba6b416d4d065
- MD5 106663a507e1b7b4586fea07fc5daf60
- SHA1 e83e32591ba1079262bc3df3b7a961fb53ad38aa
- SHA512 2bf0eed6119e1f759c3ba451af69c5b0e5d429e1f53e518a2cae7700f45681b72772d232ba1d06ac01dc59c36c4331fee36465f149abc377be4487abb7e1859d
- SSDEEP 24576:6lrcUsXqkQOC1aO0OHZK22Pfz+740hgaMX7gID:6hrOCPbHV7VIHD
- TLSH T16045BE52BF971DF9F46581314716496EBDD378320AF125BB12CCE70B0E2A6909BFAE10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext