2026-07-01_3fcf73a642d09b738fd32499be58c873_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_3fcf73a642d09b738fd32499be58c873_cobalt-strike_icedid
Size 275KB
Sample260701-l3teeabs4m
SHA256 ee712abba40b0d898c11637cd34298036bbda9df568230bc1f3c887352c301fe
MD5 3fcf73a642d09b738fd32499be58c873
SHA1 92d0343fd85dece9c4be8a1f016e0ea53f507ef2
SHA512 570bc409af97fb953ea17d73160a38997dc321d13a2a485eb61c38bd0fc5dcabf7b8ad5bc433c2c5f770a79abc93ed96542bff54c58492fc97ca8f7b2653edd8
SSDEEP 6144:qI18XRjTl+dKXHkDBfm0U/b8cdRJ3Sgi1:N8v+dvQgcpiz1
TLSH
T1F0548D1AE6A10CFDE1B7C174CA464905EBB1F84A47609BDF07D049963E276E09E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_3fcf73a642d09b738fd32499be58c873_cobalt-strike_icedid

File Explorer

2026-07-01_3fcf73a642d09b738fd32499be58c873_cobalt-strike_icedid

.exe 275KB

2026-07-01_3fcf73a642d09b738fd32499be58c873_cobalt-strike_icedid

IMPHASH 9610e44e01caa324283d6dcb49d3a8db
SHA256 ee712abba40b0d898c11637cd34298036bbda9df568230bc1f3c887352c301fe
MD5 3fcf73a642d09b738fd32499be58c873
SHA1 92d0343fd85dece9c4be8a1f016e0ea53f507ef2
SHA512 570bc409af97fb953ea17d73160a38997dc321d13a2a485eb61c38bd0fc5dcabf7b8ad5bc433c2c5f770a79abc93ed96542bff54c58492fc97ca8f7b2653edd8
SSDEEP 6144:qI18XRjTl+dKXHkDBfm0U/b8cdRJ3Sgi1:N8v+dvQgcpiz1
TLSH
T1F0548D1AE6A10CFDE1B7C174CA464905EBB1F84A47609BDF07D049963E276E09E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl

bcrypt

BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGetProperty BCryptDestroyKey BCryptEncrypt

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

iphlpapi

GetAdaptersInfo

kernel32

IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetACP SetFilePointerEx GetFileType HeapFree HeapAlloc GetOEMCP GetComputerNameA GetModuleFileNameA GetLogicalDrives QueryInformationJobObject Process32First VirtualProtect SetLastError GetCurrentProcess OutputDebugStringA DuplicateHandle IsProcessInJob GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetLastError OpenMutexA GetFileAttributesA RaiseFailFastException QueryFullProcessImageNameA CreateFileA GetCurrentThread Process32Next CloseHandle GetThreadContext GetProcAddress GetFileSize ExitProcess GetCurrentProcessId GlobalMemoryStatusEx CheckRemoteDebuggerPresent VirtualAlloc GetSystemInfo FlushInstructionCache GetTickCount VirtualQuery K32GetModuleBaseNameA K32EnumProcessModules UnmapViewOfFile K32GetModuleFileNameExA CreateFileMappingA MapViewOfFile GetSystemDirectoryA SetConsoleCtrlHandler Sleep HeapWalk GetProcessHeap GetCPInfo ReadFile Thread32Next K32GetDeviceDriverBaseNameA Thread32First GetEnvironmentVariableA CreateFileW GetSystemDirectoryW RaiseException AddVectoredExceptionHandler GetDiskFreeSpaceExA WriteProcessMemory TerminateProcess ResumeThread GetWindowsDirectoryW VirtualAllocEx CreateProcessW VirtualFreeEx SetThreadContext GetFileAttributesW CreateThread GetCurrentDirectoryW VirtualFree LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW K32EnumDeviceDrivers IsDebuggerPresent InitializeSListHead WideCharToMultiByte MultiByteToWideChar LocalFree WakeAllConditionVariable GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

FindWindowA EnableWindow SetForegroundWindow UpdateWindow RegisterClassExA GetWindowThreadProcessId GetKeyboardLayoutList GetForegroundWindow GetCursorPos SetTimer GetDesktopWindow SetWinEventHook GetMessageA DispatchMessageA LoadCursorA DestroyWindow PostMessageA GetSystemMetrics ShowWindow IsDialogMessageA GetWindowTextA SetWindowTextA DefWindowProcA CreateWindowExA SetFocus TranslateMessage PostQuitMessage LoadIconA GetDlgItem SendMessageA

gdi32

GetStockObject CreateFontA SetBkMode

advapi32

GetSidSubAuthority EnumServicesStatusA RegCloseKey CloseServiceHandle OpenSCManagerA RegOpenKeyExA LookupPrivilegeNameA GetSidSubAuthorityCount OpenProcessToken GetTokenInformation GetUserNameA

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_3fcf73a642d09b738fd32499be58c873_cobalt-strike_icedid

winhttp

bcrypt

rpcrt4

iphlpapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ntdll

generic