General
- Target 2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk
- Size 608KB
- Sample261027-ct5lmsce29
- SHA256 bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa
- MD5 f3a52ef1e498c22c5212864cc2e7852e
- SHA1 c996c9421803c3cec691023ff72d0cfac604fd9f
- SHA512 58f9ab0dade7c01b0f392e78c89cf2d78c5a49489c5229fc8c6a784362730b32ad04c09a1715d4ae373b45eaad34463e0149af0c572d47189e465387fb9f57c5
- SSDEEP 12288:B4XxTz+vz72mnrWpcY+cvvaT55gFWlsljt9N9CQ0m:BsxTz+Upc14vmPgHJh0m
- TLSH T15FD43A43F6A242DCD02AC97583599133F6743C4D5A30BA7F67906B651F36BA0EB2DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk
- Size 608KB
- SHA256 bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa
- MD5 f3a52ef1e498c22c5212864cc2e7852e
- SHA1 c996c9421803c3cec691023ff72d0cfac604fd9f
- SHA512 58f9ab0dade7c01b0f392e78c89cf2d78c5a49489c5229fc8c6a784362730b32ad04c09a1715d4ae373b45eaad34463e0149af0c572d47189e465387fb9f57c5
- SSDEEP 12288:B4XxTz+vz72mnrWpcY+cvvaT55gFWlsljt9N9CQ0m:BsxTz+Upc14vmPgHJh0m
- TLSH T15FD43A43F6A242DCD02AC97583599133F6743C4D5A30BA7F67906B651F36BA0EB2DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1