Extracted

• • Target
    2026-06-01_bd13c0775f8b66685c1b7484efce8d16_cobalt-strike_icedid
  • Size 126KB
  • SHA256 b757f0f92c56403c4a9b25016ceed3ce0b1fe2e1842cd2b3cffc9e9df6b9a38d
  • MD5 bd13c0775f8b66685c1b7484efce8d16
  • SHA1 059140fd521e14980d09650cf0e1638cbd7fe38a
  • SHA512 b41a2608e375f1135544468745d20b70a31705896fd99b43e44d6ef5350ff6a57938c832af0f83258c225d4faa9b81a1438196bcf7ffd07cf94911d96c41ee07
  • SSDEEP 1536:zPTDBQIY7A4Hqs1IMpFBxKGfcpvTHoSGotjolQMqZk3Bw3sWid99dlJanuv2J3:zPTDg3jfAGfc9IdotiQMq2qytPnv2J3
  • TLSH
    T1CDC3D493F6E6A4E8D06BD1778554051297F1FC7102209FBBA3527E3D3E127808E29AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2