General
- Target 2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- Sample261029-23m6dscf72
- SHA256 00e70f9c7629871e0cab99b313c3c92913903c18353e1ea3f5b1965fc8044911
- MD5 9757f1aa3781cee83164562a587ca1c7
- SHA1 b19710c5bfbca87d2136a2eaa5ef074a8230f566
- SHA512 654ef0f2ccbe0d198916ddecb5867603fa43d05405ac4d478fa558c38eeffcf9c7036fb5dbaedb6c9e32e4f7e5dae24619a5850d111cd82bd67def5c75204a90
- SSDEEP 24576:JNEfAVXcuV4hSE2wJrykiq8+jngFqBMo:7EfqmEMgq8+7vT
- TLSH T1CF354A7AE3D20AFEF489EC3847EC4344B6A964AA07E3125D875B05F7D87724069DAF04
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom
- Size 1.0MB
- SHA256 00e70f9c7629871e0cab99b313c3c92913903c18353e1ea3f5b1965fc8044911
- MD5 9757f1aa3781cee83164562a587ca1c7
- SHA1 b19710c5bfbca87d2136a2eaa5ef074a8230f566
- SHA512 654ef0f2ccbe0d198916ddecb5867603fa43d05405ac4d478fa558c38eeffcf9c7036fb5dbaedb6c9e32e4f7e5dae24619a5850d111cd82bd67def5c75204a90
- SSDEEP 24576:JNEfAVXcuV4hSE2wJrykiq8+jngFqBMo:7EfqmEMgq8+7vT
- TLSH T1CF354A7AE3D20AFEF489EC3847EC4344B6A964AA07E3125D875B05F7D87724069DAF04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext