General
- Target 2026-10-28_0ee2962445b4ee79e2997c0a31b9ab8e_cobalt-strike_icedid_ryuk_satacom
- Size 1.1MB
- Sample261030-mdyhhaxyhs
- SHA256 a0478c3a6ca9f094bef9da6ebbea49687701d5e0a3d6a7e28ed9b1c1ff37fde0
- MD5 0ee2962445b4ee79e2997c0a31b9ab8e
- SHA1 9be93b05382587ea4a9375f10e730298f82ae62f
- SHA512 a42025e7d514ca551621bdd6509e82838aba3d364d66f059b04d7d300f3892d85021a05968c758d5e3d5215c5ee87a9cb92f084dace4d66fc250f5b5e2885e31
- SSDEEP 12288:l8s3Sx6yDiNT1AdKhK+BD0oiXYG2xlSOJVEe4y4vseinQfglEIX4hsMO4K59hPj:f6pr1s0tOge4y4hez4hPRo9j
- TLSH T10845D091B7C40DFCF52A89318596EA2451223D221FE118EFD6BCD345CE376C19BFAA09
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_0ee2962445b4ee79e2997c0a31b9ab8e_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_0ee2962445b4ee79e2997c0a31b9ab8e_cobalt-strike_icedid_ryuk_satacom
- Size 1.1MB
- SHA256 a0478c3a6ca9f094bef9da6ebbea49687701d5e0a3d6a7e28ed9b1c1ff37fde0
- MD5 0ee2962445b4ee79e2997c0a31b9ab8e
- SHA1 9be93b05382587ea4a9375f10e730298f82ae62f
- SHA512 a42025e7d514ca551621bdd6509e82838aba3d364d66f059b04d7d300f3892d85021a05968c758d5e3d5215c5ee87a9cb92f084dace4d66fc250f5b5e2885e31
- SSDEEP 12288:l8s3Sx6yDiNT1AdKhK+BD0oiXYG2xlSOJVEe4y4vseinQfglEIX4hsMO4K59hPj:f6pr1s0tOge4y4hez4hPRo9j
- TLSH T10845D091B7C40DFCF52A89318596EA2451223D221FE118EFD6BCD345CE376C19BFAA09
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext