2026-01-21_d94c022e469a86a64294e2a7d9bdcd4c_cobalt-strike_icedid_stealc

General

Target
2026-01-21_d94c022e469a86a64294e2a7d9bdcd4c_cobalt-strike_icedid_stealc
Size 281KB
Sample260121-cm2w6sdt5c
SHA256 695a94b0d5f2b955875326d916dfc387783f9e033a7fba7a8bde727e3941914a
MD5 d94c022e469a86a64294e2a7d9bdcd4c
SHA1 8d09e93ce1627f9a60a9c4ff8f18a0e2d1a77400
SHA512 85255d75bae329ffc88d9f88d7bccc7035df386498c1bc2590e4fc1f3ab79e588128132295ea88ee962997f2348c4a0dae442f95f773a248b0258182ec9a0769
SSDEEP 3072:B2D/V1HJAASoYyqgUBh8rIb59TTElevVFg2Wf35KQEIH3HNHi4i:Q7V+XBh829T/74793B7i
TLSH
T19F54088FE95E84EDC97BC4F6A2121144F6913CDA8770A38B2FC416561F93AE09C783C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-01-21_d94c022e469a86a64294e2a7d9bdcd4c_cobalt-strike_icedid_stealc

File Explorer

2026-01-21_d94c022e469a86a64294e2a7d9bdcd4c_cobalt-strike_icedid_stealc

.exe 281KB

2026-01-21_d94c022e469a86a64294e2a7d9bdcd4c_cobalt-strike_icedid_stealc

IMPHASH fa27ff6e4043e3a0ed9cb3129734a949
SHA256 695a94b0d5f2b955875326d916dfc387783f9e033a7fba7a8bde727e3941914a
MD5 d94c022e469a86a64294e2a7d9bdcd4c
SHA1 8d09e93ce1627f9a60a9c4ff8f18a0e2d1a77400
SHA512 85255d75bae329ffc88d9f88d7bccc7035df386498c1bc2590e4fc1f3ab79e588128132295ea88ee962997f2348c4a0dae442f95f773a248b0258182ec9a0769
SSDEEP 3072:B2D/V1HJAASoYyqgUBh8rIb59TTElevVFg2Wf35KQEIH3HNHi4i:Q7V+XBh829T/74793B7i
TLSH
T19F54088FE95E84EDC97BC4F6A2121144F6913CDA8770A38B2FC416561F93AE09C783C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

87840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep GetCurrentProcess GetCurrentThread GetSystemTime GetVersion GetModuleHandleA GetProcAddress LoadLibraryA WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW MultiByteToWideChar FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-01-21_d94c022e469a86a64294e2a7d9bdcd4c_cobalt-strike_icedid_stealc

kernel32

generic