2026-04-24_ea0273892806d1965ad87d71996632b8_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-24_ea0273892806d1965ad87d71996632b8_cobalt-strike_icedid
Size 147KB
Sample260424-ll7kpse13j
SHA256 7b5e0f812ddc28d56a3ff0d3a0f7f047a2f473a352ecb2c1897465eeaf1700b2
MD5 ea0273892806d1965ad87d71996632b8
SHA1 3fcb2bc2f80f9e1391c67b1cbbf036da595ff5e7
SHA512 c18322b7f0882586e64db4545bf2024c2acb4260168897aa05f30f270f9a20d71fc7aeee82337a6597362f2266e798cce7ff3c7d4652cc99e26609b0a870e4a1
SSDEEP 3072:iCH9PTomtToikZuzsEoOgfyT54hx1/Eph/AFuzp9lE8YQy:eyojZuwED4hf/er28Z
TLSH
T1B6E34A47B2A630F8D5B6C13984A15615E7B2BC351760ABEF07A07A172F336E09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-24_ea0273892806d1965ad87d71996632b8_cobalt-strike_icedid

File Explorer

2026-04-24_ea0273892806d1965ad87d71996632b8_cobalt-strike_icedid

.exe 147KB

2026-04-24_ea0273892806d1965ad87d71996632b8_cobalt-strike_icedid

IMPHASH 98542742d40ec559c0b2be1029d43198
SHA256 7b5e0f812ddc28d56a3ff0d3a0f7f047a2f473a352ecb2c1897465eeaf1700b2
MD5 ea0273892806d1965ad87d71996632b8
SHA1 3fcb2bc2f80f9e1391c67b1cbbf036da595ff5e7
SHA512 c18322b7f0882586e64db4545bf2024c2acb4260168897aa05f30f270f9a20d71fc7aeee82337a6597362f2266e798cce7ff3c7d4652cc99e26609b0a870e4a1
SSDEEP 3072:iCH9PTomtToikZuzsEoOgfyT54hx1/Eph/AFuzp9lE8YQy:eyojZuwED4hf/er28Z
TLSH
T1B6E34A47B2A630F8D5B6C13984A15615E7B2BC351760ABEF07A07A172F336E09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid

shell32

ShellExecuteExA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantInit SysAllocString SysFreeString

kernel32

WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW GetFileType SetStdHandle GetCommandLineA CreateFileA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject CreateMutexA Sleep GetProcessTimes GetCurrentProcessId ExitProcess GetExitCodeProcess CreateThread CreateProcessA InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA MultiByteToWideChar LocalFree SetEnvironmentVariableW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW GetModuleHandleExW GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-24_ea0273892806d1965ad87d71996632b8_cobalt-strike_icedid

advapi32

shell32

ole32

oleaut32

kernel32

generic