General
- Target 2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom
- Size 966KB
- Sample261024-2tkc5sew6n
- SHA256 c762e366717cb812d856699d76405568e80808d55a9eb81120731df7c6f51af3
- MD5 0529a6f0e551164b4160d12f912a7efc
- SHA1 ecc0f4e4eb5039a2acba79efa95f4731232396b8
- SHA512 9016d2ffa61510ef3310a531d5f45c95cade4897cbbb4b1ae06edafacee7eeea12ca13b199ad83840fa05022b6bf1e6fedeeaa88072982985d8008e77e5297c3
- SSDEEP 24576:A8wABsZ8wpefL1eQCuUgHh9oYt3aSNJSxPHlGaUp:hw1xpezQQQgHhyYdaqSxNV
- TLSH T111250152F3A500F9E16BC1788A478516EA72BC16476076DB37A02E9A3F23BD05F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom
- Size 966KB
- SHA256 c762e366717cb812d856699d76405568e80808d55a9eb81120731df7c6f51af3
- MD5 0529a6f0e551164b4160d12f912a7efc
- SHA1 ecc0f4e4eb5039a2acba79efa95f4731232396b8
- SHA512 9016d2ffa61510ef3310a531d5f45c95cade4897cbbb4b1ae06edafacee7eeea12ca13b199ad83840fa05022b6bf1e6fedeeaa88072982985d8008e77e5297c3
- SSDEEP 24576:A8wABsZ8wpefL1eQCuUgHh9oYt3aSNJSxPHlGaUp:hw1xpezQQQgHhyYdaqSxNV
- TLSH T111250152F3A500F9E16BC1788A478516EA72BC16476076DB37A02E9A3F23BD05F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1