General
- Target 2026-10-26_43a9b2bd212455b6a3f5c56e1bc2aeef_cobalt-strike_icedid_ryuk
- Size 596KB
- Sample261027-xjempawves
- SHA256 3c188b7f04b5744645f2d2cce049692b5a613f82a4bfeab4eec5f6a569e6c754
- MD5 43a9b2bd212455b6a3f5c56e1bc2aeef
- SHA1 cecb291dbe7f405214d1454eaf0b175edf3b3cf6
- SHA512 fa768fd3752309b22cfc68c870856bd174c48a00945344c7706b0316f8d84c4d2706f41e07a1f8aab81dec92590dce27b68c7fd8bbba2e9b84f74222878fc522
- SSDEEP 12288:TLbgyhRDFK560BswqKarsARVyAMQusEFVxaE+2V1yJuizf/:vbgyLRKU0BsJrJ7PMaCV7mU
- TLSH T1B1D43913F79286ECD02AC87583559133F6753C894A30BA7B67945B251F36BA0EB3DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_43a9b2bd212455b6a3f5c56e1bc2aeef_cobalt-strike_icedid_ryuk.exe
Resource
win10v2004-20260911-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_43a9b2bd212455b6a3f5c56e1bc2aeef_cobalt-strike_icedid_ryuk
- Size 596KB
- SHA256 3c188b7f04b5744645f2d2cce049692b5a613f82a4bfeab4eec5f6a569e6c754
- MD5 43a9b2bd212455b6a3f5c56e1bc2aeef
- SHA1 cecb291dbe7f405214d1454eaf0b175edf3b3cf6
- SHA512 fa768fd3752309b22cfc68c870856bd174c48a00945344c7706b0316f8d84c4d2706f41e07a1f8aab81dec92590dce27b68c7fd8bbba2e9b84f74222878fc522
- SSDEEP 12288:TLbgyhRDFK560BswqKarsARVyAMQusEFVxaE+2V1yJuizf/:vbgyLRKU0BsJrJ7PMaCV7mU
- TLSH T1B1D43913F79286ECD02AC87583559133F6753C894A30BA7B67945B251F36BA0EB3DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2