General
- Target 2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom
- Size 5.1MB
- Sample261027-a1pgwsxt9n
- SHA256 dcb8d9955ea121e913c48f54477d49770d42898894e73860ca2cf86f14c2b9d8
- MD5 fffd116becb3bb91d7de2f4b264fef44
- SHA1 4e89a82506fdc617835d052fd2bf3a2c925ba251
- SHA512 1f8f1759b498d383f5ee2d003e842253cc9f36c6cb89ca9e4879a7e07a7ae6044c0f040b44ca61c12c394c60ffb7fd21f7180b746bda18299af1755e046f6c60
- SSDEEP 49152:PKjPpkBqsRqeKdzjA9DbKcM3GHFSanKyAqErPJKUfOkbSICcIFwC0KHLkT/M+whB:U1SC13GosGVbgzFrmwIYbJzl8Nw
- TLSH T11036BF13F2D901E8E0AED1788B669233EA72BC458B35B6DF065076251F76EE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom
- Size 5.1MB
- SHA256 dcb8d9955ea121e913c48f54477d49770d42898894e73860ca2cf86f14c2b9d8
- MD5 fffd116becb3bb91d7de2f4b264fef44
- SHA1 4e89a82506fdc617835d052fd2bf3a2c925ba251
- SHA512 1f8f1759b498d383f5ee2d003e842253cc9f36c6cb89ca9e4879a7e07a7ae6044c0f040b44ca61c12c394c60ffb7fd21f7180b746bda18299af1755e046f6c60
- SSDEEP 49152:PKjPpkBqsRqeKdzjA9DbKcM3GHFSanKyAqErPJKUfOkbSICcIFwC0KHLkT/M+whB:U1SC13GosGVbgzFrmwIYbJzl8Nw
- TLSH T11036BF13F2D901E8E0AED1788B669233EA72BC458B35B6DF065076251F76EE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1