2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom

General

Target
2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom
Size 1.1MB
Sample261024-dybd2ahv5p
SHA256 2eefa765980ba35c50047822903895501061062d17cccc296edd2ae8df3e5099
MD5 9ac1869934ee3fa7882c4cbdb75a2f55
SHA1 ca53c9d48a0357482ec9bbbe2073da0d4bc79ac6
SHA512 ef51dab57081b0533c913f913a85439909aa18e2c74f9b3738d60f36fc5d8d7e9f1b1a160475be17d825964a7b7c20db503c09435d25c333516801e6a6f28bf5
SSDEEP 24576:0VdORUV3AiN6MsohGLL7mgppQtaM2wrh6fOpCp:wAasbktx2Yk
TLSH
T1C145E061F3953EF5F42A85F08971E1028A31BC151BD01AFBA28C17DB4D32AD1BBFA615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom

File Explorer

2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom

.exe 1.1MB

2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom

IMPHASH ed9fc02075c0fb67c253f2b8af148924
SHA256 2eefa765980ba35c50047822903895501061062d17cccc296edd2ae8df3e5099
MD5 9ac1869934ee3fa7882c4cbdb75a2f55
SHA1 ca53c9d48a0357482ec9bbbe2073da0d4bc79ac6
SHA512 ef51dab57081b0533c913f913a85439909aa18e2c74f9b3738d60f36fc5d8d7e9f1b1a160475be17d825964a7b7c20db503c09435d25c333516801e6a6f28bf5
SSDEEP 24576:0VdORUV3AiN6MsohGLL7mgppQtaM2wrh6fOpCp:wAasbktx2Yk
TLSH
T1C145E061F3953EF5F42A85F08971E1028A31BC151BD01AFBA28C17DB4D32AD1BBFA615
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

87840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

peasle.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLargePageMinimum GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPhysicallyInstalledSystemMemory GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessHandleCount GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetSystemTimes GetTickCount64 GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

GetActiveWindow GetClientRect GetDesktopWindow GetDpiForSystem GetDpiForWindow GetFocus GetForegroundWindow GetSysColor GetSystemMetrics SystemParametersInfoW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

386KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

233B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic