2026-07-19_02516a72a832c0bce109d9d117cd09c1_cobalt-strike_icedid_ryuk

General

Target
2026-07-19_02516a72a832c0bce109d9d117cd09c1_cobalt-strike_icedid_ryuk
Size 105KB
Sample260720-cdbnmaex3w
SHA256 5489f6553886929b3776895c099ac00ff1d81270c8e06ece65fbc2dfd74cc731
MD5 02516a72a832c0bce109d9d117cd09c1
SHA1 4fad5f17f41b1cdfe8487fcc742c5908c0cbd73d
SHA512 57d25f0f54fd7075fe0f37f86baa39bb85cf32102742bc80dc4a7e35f43491fede1fa25957393ea6a0d172b43e06071e6c69096712b75692668b2a33467f6988
SSDEEP 1536:KAZRB73zYEBhP2GjcKwya/txTH5S5rCai0oejosI9dlVzjgfsk6egyogJt3OcS9:KAtoEHNFwbF5ZErCaBoWosY7UB3Do
TLSH
T180B34A5767E530E9E1778238C4624A09EB73B8724B50AFEF03A4066A1F636D05D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_02516a72a832c0bce109d9d117cd09c1_cobalt-strike_icedid_ryuk

File Explorer

2026-07-19_02516a72a832c0bce109d9d117cd09c1_cobalt-strike_icedid_ryuk

.exe 105KB

2026-07-19_02516a72a832c0bce109d9d117cd09c1_cobalt-strike_icedid_ryuk

IMPHASH 1d08162259d017fbb6444dabbc775fdd
SHA256 5489f6553886929b3776895c099ac00ff1d81270c8e06ece65fbc2dfd74cc731
MD5 02516a72a832c0bce109d9d117cd09c1
SHA1 4fad5f17f41b1cdfe8487fcc742c5908c0cbd73d
SHA512 57d25f0f54fd7075fe0f37f86baa39bb85cf32102742bc80dc4a7e35f43491fede1fa25957393ea6a0d172b43e06071e6c69096712b75692668b2a33467f6988
SSDEEP 1536:KAZRB73zYEBhP2GjcKwya/txTH5S5rCai0oejosI9dlVzjgfsk6egyogJt3OcS9:KAtoEHNFwbF5ZErCaBoWosY7UB3Do
TLSH
T180B34A5767E530E9E1778238C4624A09EB73B8724B50AFEF03A4066A1F636D05D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW

kernel32

CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTickCount64 HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_02516a72a832c0bce109d9d117cd09c1_cobalt-strike_icedid_ryuk

user32

kernel32

generic