General
- Target 2026-10-26_e33c7e6b4c44ded3f36925d6b314ccf1_cobalt-strike_icedid_ryuk_satacom
- Size 3.7MB
- Sample261027-e1xkqabt6m
- SHA256 366350dd3b0b95f083bc3d1e309a0324e72de2960a977219a181580e0327e7b8
- MD5 e33c7e6b4c44ded3f36925d6b314ccf1
- SHA1 a2df8376a59055db0bffec5b7a949059760de8ea
- SHA512 241e2f040af9cae1a80beb0e7ebc4d68218e96472a6a00cb0384f0a6b244f33217444d8e92587c31ea413c1845ffdbdf8dec3c5ca1d3acf1288e01ce3d3b3c59
- SSDEEP 98304:FMWngv9jk2ztdYQgaA5HbYnpDLG7DIXMFXZk:uWnO8LHk6DIXMFXq
- TLSH T11706F1A6AF902CB1E6245C31147A135A5B58BD65C0D26612E5BD233A8E23CE33DFCF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_e33c7e6b4c44ded3f36925d6b314ccf1_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_e33c7e6b4c44ded3f36925d6b314ccf1_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_e33c7e6b4c44ded3f36925d6b314ccf1_cobalt-strike_icedid_ryuk_satacom
- Size 3.7MB
- SHA256 366350dd3b0b95f083bc3d1e309a0324e72de2960a977219a181580e0327e7b8
- MD5 e33c7e6b4c44ded3f36925d6b314ccf1
- SHA1 a2df8376a59055db0bffec5b7a949059760de8ea
- SHA512 241e2f040af9cae1a80beb0e7ebc4d68218e96472a6a00cb0384f0a6b244f33217444d8e92587c31ea413c1845ffdbdf8dec3c5ca1d3acf1288e01ce3d3b3c59
- SSDEEP 98304:FMWngv9jk2ztdYQgaA5HbYnpDLG7DIXMFXZk:uWnO8LHk6DIXMFXq
- TLSH T11706F1A6AF902CB1E6245C31147A135A5B58BD65C0D26612E5BD233A8E23CE33DFCF74
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext