General
- Target 2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom
- Size 311KB
- Sample261024-asemqa1xdw
- SHA256 bc901ffc6f4e96bf392371c557f42b1d670fca3668ea42a25eaf6333acb6bd4a
- MD5 af3588c3c107e58d9b8dc7c6d28b2d51
- SHA1 6dc13e3baad153efee9c19a9a5ee8972d227e3a6
- SHA512 e21bf8c3a6169bc29500dd5acf4c132a398f7e95881a5fd8c83b95d9c1557a5f76a64be900c3acfaf304fa8776bcf696490586921187b9e5201acbcae04f7e03
- SSDEEP 6144:5Eeu4A1sNRiWMrkbUnADZ8rK1HJIth0IfgoNnWDinsuquta3wtj:5Eer2WckbKw+zth0wTmujagtj
- TLSH T1B3649C1B17A4A4EAD2119B3C9891E728877773B0FB15C7EF566106C52E21FC38E3DA90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom
- Size 311KB
- SHA256 bc901ffc6f4e96bf392371c557f42b1d670fca3668ea42a25eaf6333acb6bd4a
- MD5 af3588c3c107e58d9b8dc7c6d28b2d51
- SHA1 6dc13e3baad153efee9c19a9a5ee8972d227e3a6
- SHA512 e21bf8c3a6169bc29500dd5acf4c132a398f7e95881a5fd8c83b95d9c1557a5f76a64be900c3acfaf304fa8776bcf696490586921187b9e5201acbcae04f7e03
- SSDEEP 6144:5Eeu4A1sNRiWMrkbUnADZ8rK1HJIth0IfgoNnWDinsuquta3wtj:5Eer2WckbKw+zth0wTmujagtj
- TLSH T1B3649C1B17A4A4EAD2119B3C9891E728877773B0FB15C7EF566106C52E21FC38E3DA90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.