2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk
Size 608KB
Sample261027-ct5lmsce29
SHA256 bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa
MD5 f3a52ef1e498c22c5212864cc2e7852e
SHA1 c996c9421803c3cec691023ff72d0cfac604fd9f
SHA512 58f9ab0dade7c01b0f392e78c89cf2d78c5a49489c5229fc8c6a784362730b32ad04c09a1715d4ae373b45eaad34463e0149af0c572d47189e465387fb9f57c5
SSDEEP 12288:B4XxTz+vz72mnrWpcY+cvvaT55gFWlsljt9N9CQ0m:BsxTz+Upc14vmPgHJh0m
TLSH
T15FD43A43F6A242DCD02AC97583599133F6743C4D5A30BA7F67906B651F36BA0EB2DB08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk

File Explorer

2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk

.exe 608KB

2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk

IMPHASH 15d85b0b1166960543f973acaab6b01d
SHA256 bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa
MD5 f3a52ef1e498c22c5212864cc2e7852e
SHA1 c996c9421803c3cec691023ff72d0cfac604fd9f
SHA512 58f9ab0dade7c01b0f392e78c89cf2d78c5a49489c5229fc8c6a784362730b32ad04c09a1715d4ae373b45eaad34463e0149af0c572d47189e465387fb9f57c5
SSDEEP 12288:B4XxTz+vz72mnrWpcY+cvvaT55gFWlsljt9N9CQ0m:BsxTz+Upc14vmPgHJh0m
TLSH
T15FD43A43F6A242DCD02AC97583599133F6743C4D5A30BA7F67906B651F36BA0EB2DB08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

157370

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

grelifean.pdb

kernel32

CloseHandle CompareStringOrdinal CreateFileW CreateThread CreateWaitableTimerExW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeLibrary GetACP GetCPInfo GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleTitleW GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleHandleExW GetModuleHandleW GetNumberOfConsoleInputEvents GetOEMCP GetPriorityClass GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessTimes GetStdHandle GetStringTypeW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter SetWaitableTimer Sleep SwitchToThread TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

GetActiveWindow GetClientRect GetDesktopWindow GetSystemMetrics

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

486KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

91B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic