General
- Target 2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom
- Size 2.4MB
- Sample261027-he7eksbz8r
- SHA256 449f9b5bf9ab1718842f681b4f68986444ef4b360648608a886ec0e9baeb1535
- MD5 cbed7c60caa4a9b40ab8b7db71f5464c
- SHA1 7fab0edc2e5be935054bc21798718e1fdd39c3ad
- SHA512 2391f8faab5af7af51f4d59a8cce18982fe478700ec08b790f36530c655173dc29d68bc1e1d02af56991b83db2fa7ede0f037e8098b91a8dd21e9469c2926bb0
- SSDEEP 24576:UQ70zgMOK4lmREEa9d5Tizs1IN7BOcXbX:t0zgMWlmREl1iI1yBO
- TLSH T155C50807A3629E75F09084BD11100CC8FCA2641997B7A5A75E6E721ACF7BE434AFF532
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom
- Size 2.4MB
- SHA256 449f9b5bf9ab1718842f681b4f68986444ef4b360648608a886ec0e9baeb1535
- MD5 cbed7c60caa4a9b40ab8b7db71f5464c
- SHA1 7fab0edc2e5be935054bc21798718e1fdd39c3ad
- SHA512 2391f8faab5af7af51f4d59a8cce18982fe478700ec08b790f36530c655173dc29d68bc1e1d02af56991b83db2fa7ede0f037e8098b91a8dd21e9469c2926bb0
- SSDEEP 24576:UQ70zgMOK4lmREEa9d5Tizs1IN7BOcXbX:t0zgMWlmREl1iI1yBO
- TLSH T155C50807A3629E75F09084BD11100CC8FCA2641997B7A5A75E6E721ACF7BE434AFF532
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext