General
- Target 2026-11-12_5b24b08c50ad0654fc855212ee97c940_cobalt-strike_emotet_icedid_remcos_ryuk_satacom
- Size 3.0MB
- Sample261113-csgs7aey51
- SHA256 e2ab9ede6baf28c81cece7c617b1551f01df4abecadfc5e96432f840b5e9ad6f
- MD5 5b24b08c50ad0654fc855212ee97c940
- SHA1 c1056cca0c9d9bcbbded29b58c08d9ab0f705acc
- SHA512 f63547494585166c5dcd8690717c7583a02ced23a79054d50b189325da3c6af8ee3795c5aff350eba2286d2ebfa2d4fb133438f4f2fe1e8076787f5b02faf887
- SSDEEP 49152:WhPYg0cUOIbUNEWWDKgFXpe88TnE2g2KFujs2:WdJ0cUOIANEWWDKgFXpe8+tg2KFuN
- TLSH T1A5E55CDB2077069EF0A9C93458F0167BDD7BCD629F40C82312B39EB9BD123A09E5E855
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-12_5b24b08c50ad0654fc855212ee97c940_cobalt-strike_emotet_icedid_remcos_ryuk_satacom.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-12_5b24b08c50ad0654fc855212ee97c940_cobalt-strike_emotet_icedid_remcos_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-12_5b24b08c50ad0654fc855212ee97c940_cobalt-strike_emotet_icedid_remcos_ryuk_satacom
- Size 3.0MB
- SHA256 e2ab9ede6baf28c81cece7c617b1551f01df4abecadfc5e96432f840b5e9ad6f
- MD5 5b24b08c50ad0654fc855212ee97c940
- SHA1 c1056cca0c9d9bcbbded29b58c08d9ab0f705acc
- SHA512 f63547494585166c5dcd8690717c7583a02ced23a79054d50b189325da3c6af8ee3795c5aff350eba2286d2ebfa2d4fb133438f4f2fe1e8076787f5b02faf887
- SSDEEP 49152:WhPYg0cUOIbUNEWWDKgFXpe88TnE2g2KFujs2:WdJ0cUOIANEWWDKgFXpe8+tg2KFuN
- TLSH T1A5E55CDB2077069EF0A9C93458F0167BDD7BCD629F40C82312B39EB9BD123A09E5E855
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Suspicious use of SetThreadContext