4d51d84f65da8f5a3691014cc35be36d74dcd05140e6a1bc1fc4e22200cbbd9e

General

Target
2026-07-07_07b2a492424db179522d50b6b6a5ec6b_cobalt-strike_icedid
Size 10.1MB
Sample260707-m1wmesdv7l
SHA256 4d51d84f65da8f5a3691014cc35be36d74dcd05140e6a1bc1fc4e22200cbbd9e
MD5 07b2a492424db179522d50b6b6a5ec6b
SHA1 d8eac4621da633e6c91bfbb78b2e6dac02d78187
SHA512 fabd48dd874f73923865907a065261738bf8714e1cc7898f89001663cdc3642b1900929175aad8af53d0341fde61f4f8693fe4de92d2d3dfa8e7b75b15c19700
SSDEEP 12288:EvL4e4bjvTTrenE+Zssp131zn65Ir8xGf:EvYn1q31Lsxk
TLSH
T132B6E117BAAA38F6D5A74278A4E65281DF22BC3A07215FEF079002DE0F566D05D39F70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-07_07b2a492424db179522d50b6b6a5ec6b_cobalt-strike_icedid
- Size 10.1MB
- SHA256 4d51d84f65da8f5a3691014cc35be36d74dcd05140e6a1bc1fc4e22200cbbd9e
- MD5 07b2a492424db179522d50b6b6a5ec6b
- SHA1 d8eac4621da633e6c91bfbb78b2e6dac02d78187
- SHA512 fabd48dd874f73923865907a065261738bf8714e1cc7898f89001663cdc3642b1900929175aad8af53d0341fde61f4f8693fe4de92d2d3dfa8e7b75b15c19700
- SSDEEP 12288:EvL4e4bjvTTrenE+Zssp131zn65Ir8xGf:EvYn1q31Lsxk
- TLSH
  T132B6E117BAAA38F6D5A74278A4E65281DF22BC3A07215FEF079002DE0F566D05D39F70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection discovery persistence privilege_escalation spyware stealer adware
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables referencing many IR and analysis tools
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  Detects executables referencing many email and collaboration clients. Observed in information steale
- Custom signature
  
  Detects executables referencing many file transfer clients. Observed in information stealers
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2