General
- Target 2026-10-26_be643b85885e85e8b5e94a325a5666b3_cobalt-strike_icedid_ryuk_satacom
- Size 1.1MB
- Sample261027-js2xpact9r
- SHA256 f36ede1998e1fd0817587299169cb0ed37ef92f0443498660061d711827a6c83
- MD5 be643b85885e85e8b5e94a325a5666b3
- SHA1 079e8f1491d3176c0ec920d6b1dcf86ea5c88e84
- SHA512 cefabf5c01994d1d5cc8b47eb12c7a14e13c815638cf244f8fa61a93be39f96d6367c054bc9b18f34d732045c9beb91cfedd1e7cc09908eebe72c8c3f62842bc
- SSDEEP 12288:iPrpGIp560SzfSNo8jH+PjvvuNBbtr+0v2HKQ3WL8iKrL6JPhReNKTqSMboR/As:iPrpvpQX8jH+uN98mMKQssv6J7jRReU
- TLSH T167457D62FF631CBBF528947BAE170CDC8A7D2B5206F431A9525E12968D3B5B08DF1213
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_be643b85885e85e8b5e94a325a5666b3_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_be643b85885e85e8b5e94a325a5666b3_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_be643b85885e85e8b5e94a325a5666b3_cobalt-strike_icedid_ryuk_satacom
- Size 1.1MB
- SHA256 f36ede1998e1fd0817587299169cb0ed37ef92f0443498660061d711827a6c83
- MD5 be643b85885e85e8b5e94a325a5666b3
- SHA1 079e8f1491d3176c0ec920d6b1dcf86ea5c88e84
- SHA512 cefabf5c01994d1d5cc8b47eb12c7a14e13c815638cf244f8fa61a93be39f96d6367c054bc9b18f34d732045c9beb91cfedd1e7cc09908eebe72c8c3f62842bc
- SSDEEP 12288:iPrpGIp560SzfSNo8jH+PjvvuNBbtr+0v2HKQ3WL8iKrL6JPhReNKTqSMboR/As:iPrpvpQX8jH+uN98mMKQssv6J7jRReU
- TLSH T167457D62FF631CBBF528947BAE170CDC8A7D2B5206F431A9525E12968D3B5B08DF1213
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext