General
- Target 2026-10-26_b57c9c8bbab279d28a819c3f8eee35b8_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- Sample261027-kl9jmacx4m
- SHA256 d5a8295a9e761c94b5dbd3c149d3e8e40903214ad5da50a93befc78b4bd7a364
- MD5 b57c9c8bbab279d28a819c3f8eee35b8
- SHA1 bd06bd2e2b8f7b6aa8b257bd1e0389c547bee171
- SHA512 a0ff26aa89782b60dc856943c58f75fd7378306a09917b39da16209648c39524100a2c88ed01efa93feb744995b145987cc590b1f5ea06ee994f80ae93186511
- SSDEEP 12288:0YjdZN/gYixQckupVQwEGklCn8jcyXQoIEEZXmogt+VcikQRYN5+SooqGPX6:L5Xji11EGklC8wyAoIEEkXt+6Ifi7v6
- TLSH T1DD356835B2550AB9F036C13456DC0531D66928CCC6EF7EBE030BD7160DE2E9E8AEA65C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_b57c9c8bbab279d28a819c3f8eee35b8_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_b57c9c8bbab279d28a819c3f8eee35b8_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_b57c9c8bbab279d28a819c3f8eee35b8_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- SHA256 d5a8295a9e761c94b5dbd3c149d3e8e40903214ad5da50a93befc78b4bd7a364
- MD5 b57c9c8bbab279d28a819c3f8eee35b8
- SHA1 bd06bd2e2b8f7b6aa8b257bd1e0389c547bee171
- SHA512 a0ff26aa89782b60dc856943c58f75fd7378306a09917b39da16209648c39524100a2c88ed01efa93feb744995b145987cc590b1f5ea06ee994f80ae93186511
- SSDEEP 12288:0YjdZN/gYixQckupVQwEGklCn8jcyXQoIEEZXmogt+VcikQRYN5+SooqGPX6:L5Xji11EGklC8wyAoIEEkXt+6Ifi7v6
- TLSH T1DD356835B2550AB9F036C13456DC0531D66928CCC6EF7EBE030BD7160DE2E9E8AEA65C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext