2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid

General

Target
2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid
Size 473KB
Sample260701-ef5etsfy2v
SHA256 5e1bc0c513824834b48ccd088bf1b9e112a0c650f930fe042a582f6aab1ab421
MD5 8d5944e69ec9d5578cc17348f5eb97e7
SHA1 d7134364bc57683ada0e4e8c07abe71db61a673b
SHA512 be0b4b93a0f390fa92ce72ddbf72c61e48a266353b9c4d4cf24419f2cedf5c5f1cd2550d06c654d785894fa2dbdd5c3f378aa359b6bacf550194166e6c4145e5
SSDEEP 6144:tTtB4hw0ub3L5wYPbMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmR4k88e:tTtIw0k6YP71Nfhu+1mqTnNFmR48e
TLSH
T1FAA49D86F79269FAEC7A853C89A24B29FB71F4240360C7DF26944196DF133D04E3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid

File Explorer

2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid

.exe 473KB

2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid

IMPHASH 2fcb5d37c9430073918d258f791f1ec8
SHA256 5e1bc0c513824834b48ccd088bf1b9e112a0c650f930fe042a582f6aab1ab421
MD5 8d5944e69ec9d5578cc17348f5eb97e7
SHA1 d7134364bc57683ada0e4e8c07abe71db61a673b
SHA512 be0b4b93a0f390fa92ce72ddbf72c61e48a266353b9c4d4cf24419f2cedf5c5f1cd2550d06c654d785894fa2dbdd5c3f378aa359b6bacf550194166e6c4145e5
SSDEEP 6144:tTtB4hw0ub3L5wYPbMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmR4k88e:tTtIw0k6YP71Nfhu+1mqTnNFmR48e
TLSH
T1FAA49D86F79269FAEC7A853C89A24B29FB71F4240360C7DF26944196DF133D04E3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

kernel32

EncodePointer WriteConsoleW CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile RemoveDirectoryA SetFilePointer WriteFile GetTempPathA CloseHandle HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep CreateProcessA GetTickCount GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW CreateFileW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid

user32

kernel32

generic