General
- Target 2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom
- Size 703KB
- Sample261113-3rx2wsas3w
- SHA256 808f1f3b1c63c5bead9856147bb2e19cefd8fc33db8fe187bc09d218e2736716
- MD5 c0b77a23806d47d13a6dd8a9736fccef
- SHA1 cf58ec45ed386903f9ca45bc3beb5493baeb3b0a
- SHA512 d87c1477e3b442b11ea5568be7c06dd360922d120dd4a7b663aefb5d26fe904a6e18c9c2fcad8cb54a6c1351c65a36aca45a0039a386bdff63326319534b26a1
- SSDEEP 12288:d9NsEmHQrjUfJ/m3SpioUTuFa9KNmD5gNWdYU8CI64NfkOGrGAFEHRoopqiDLjj:dvsv/Zp638gDxL4RUrNFMoopqiDLjj
- TLSH T195E40192F29941ECD027C13887121522FA7678490B2066FB47D4D77A6F27AE39F3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom
- Size 703KB
- SHA256 808f1f3b1c63c5bead9856147bb2e19cefd8fc33db8fe187bc09d218e2736716
- MD5 c0b77a23806d47d13a6dd8a9736fccef
- SHA1 cf58ec45ed386903f9ca45bc3beb5493baeb3b0a
- SHA512 d87c1477e3b442b11ea5568be7c06dd360922d120dd4a7b663aefb5d26fe904a6e18c9c2fcad8cb54a6c1351c65a36aca45a0039a386bdff63326319534b26a1
- SSDEEP 12288:d9NsEmHQrjUfJ/m3SpioUTuFa9KNmD5gNWdYU8CI64NfkOGrGAFEHRoopqiDLjj:dvsv/Zp638gDxL4RUrNFMoopqiDLjj
- TLSH T195E40192F29941ECD027C13887121522FA7678490B2066FB47D4D77A6F27AE39F3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext