2026-10-28_101ca37dda9b74b4f9767ee248fe746f_cobalt-strike_icedid_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_101ca37dda9b74b4f9767ee248fe746f_cobalt-strike_icedid_ryuk_satacom
Size 996KB
Sample261030-maftaaeb77
SHA256 f1740dd199476a75b4b104a8b3c50f0014d207ce3204c4e31b24c6ca26b61ae5
MD5 101ca37dda9b74b4f9767ee248fe746f
SHA1 0182c44560076777453b512445d6294dba957b49
SHA512 ed8094492e52a039f71c587190672f6de35152380c552a0ac0f3a11ad089099070f57f3fbc729f9f2dec1c5d59a4196ad152c4983e4c1a07ab76eab13e1204c1
SSDEEP 12288:DZVJuJdoOMEG/i8POwSRKwikIgo7MuByQvY7SOFTnfu178ine2JZ6XDSq8x4Pm:9VJu4a8PSkgo8hSeAdI2fIm
TLSH
T15D253B82A7DA2A7BF0511D3FA0445297A9B27C53358861B40ABC872EC5770D076FFB87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_101ca37dda9b74b4f9767ee248fe746f_cobalt-strike_icedid_ryuk_satacom

File Explorer

2026-10-28_101ca37dda9b74b4f9767ee248fe746f_cobalt-strike_icedid_ryuk_satacom

.exe 996KB

2026-10-28_101ca37dda9b74b4f9767ee248fe746f_cobalt-strike_icedid_ryuk_satacom

IMPHASH a0cbb5a81187f8c649c59b4a767a6b47
SHA256 f1740dd199476a75b4b104a8b3c50f0014d207ce3204c4e31b24c6ca26b61ae5
MD5 101ca37dda9b74b4f9767ee248fe746f
SHA1 0182c44560076777453b512445d6294dba957b49
SHA512 ed8094492e52a039f71c587190672f6de35152380c552a0ac0f3a11ad089099070f57f3fbc729f9f2dec1c5d59a4196ad152c4983e4c1a07ab76eab13e1204c1
SSDEEP 12288:DZVJuJdoOMEG/i8POwSRKwikIgo7MuByQvY7SOFTnfu178ine2JZ6XDSq8x4Pm:9VJu4a8PSkgo8hSeAdI2fIm
TLSH
T15D253B82A7DA2A7BF0511D3FA0445297A9B27C53358861B40ABC872EC5770D076FFB87
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

skacle.pdb

user32

BeginPaint DrawTextW EndPaint FillRect GetActiveWindow GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetInputState GetMessageExtraInfo GetMessagePos GetMessageTime GetShellWindow InvalidateRect UpdateWindow

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetActiveProcessorCount GetActiveProcessorGroupCount GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileType GetFullPathNameW GetLastError GetMaximumProcessorCount GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTempPathW GetThreadId GetTickCount GetTickCount64 GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

gdi32

TextOutW

ntdll

NtWriteFile

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

580KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

273KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_101ca37dda9b74b4f9767ee248fe746f_cobalt-strike_icedid_ryuk_satacom

user32

kernel32

gdi32

ntdll

generic