General
- Target 2026-11-01_c382441178a0885b8006bb5121d638cd_cobalt-strike_icedid_ryuk_satacom
- Size 214KB
- Sample261102-lea8xsstcs
- SHA256 dd17e898115569d4f3fbdac0b4364583393bb4f078dbd8dcce8ce4c233f45a61
Score
10/10
Malware Config
Targets
-
- Target 2026-11-01_c382441178a0885b8006bb5121d638cd_cobalt-strike_icedid_ryuk_satacom
- Size 214KB
- SHA256 dd17e898115569d4f3fbdac0b4364583393bb4f078dbd8dcce8ce4c233f45a61
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Windows security bypass
-
Executes dropped EXE
-
Registers new Windows logon scripts automatically executed at logon.
-
Windows security modification
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
2Windows Service
2