2026-07-21_99268cf298b5143bb60bcbc49cbd5943_cobalt-strike_icedid_stealc

General

Target
2026-07-21_99268cf298b5143bb60bcbc49cbd5943_cobalt-strike_icedid_stealc
Size 129KB
Sample260721-vf7sys1clf
SHA256 67229a5054aa6e8c7f7f05bdff86da66b8e54363a455a8f902141ed0b39fcdec
MD5 99268cf298b5143bb60bcbc49cbd5943
SHA1 bef29d60a5f891f694d1b806b9aa3af1211bc99a
SHA512 6ab34da48a418b3b69a79a8a91ca62cebcfe9a2c91bd4ba90c4e6f9137357493da0247fb7c710ed3eb39bab54135d57967c5cee6f4dd5e6fa6e3a94d8f2a612c
SSDEEP 3072:pLrIsu+OC6if92e+qFMLM62pdGAo7eRBG0oTWz/UH7EoCya:ZrI4OC64XFMA64GAZzfsWz/y1Cya
TLSH
T13AD37B6767EA30F9E2778238C8514655E773B8315761AFEF07A042992F236E08D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_99268cf298b5143bb60bcbc49cbd5943_cobalt-strike_icedid_stealc

File Explorer

2026-07-21_99268cf298b5143bb60bcbc49cbd5943_cobalt-strike_icedid_stealc

.exe 129KB

2026-07-21_99268cf298b5143bb60bcbc49cbd5943_cobalt-strike_icedid_stealc

IMPHASH 1e10de300bb84d91d7b9493496b37e24
SHA256 67229a5054aa6e8c7f7f05bdff86da66b8e54363a455a8f902141ed0b39fcdec
MD5 99268cf298b5143bb60bcbc49cbd5943
SHA1 bef29d60a5f891f694d1b806b9aa3af1211bc99a
SHA512 6ab34da48a418b3b69a79a8a91ca62cebcfe9a2c91bd4ba90c4e6f9137357493da0247fb7c710ed3eb39bab54135d57967c5cee6f4dd5e6fa6e3a94d8f2a612c
SSDEEP 3072:pLrIsu+OC6if92e+qFMLM62pdGAo7eRBG0oTWz/UH7EoCya:ZrI4OC64XFMA64GAZzfsWz/y1Cya
TLSH
T13AD37B6767EA30F9E2778238C8514655E773B8315761AFEF07A042992F236E08D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\window\tools\BinLoadTester\TestExeTemplates\out\x64\beginthreadex_safe_64.pdb

kernel32

GetFileSizeEx VirtualProtect SetLastError VirtualFree GetCurrentProcess WriteFile VirtualAlloc GetModuleFileNameW WaitForSingleObject CreateFileW GetCurrentThreadId GetExitCodeThread GetLastError CloseHandle CreateThread GetModuleHandleW FlushInstructionCache WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetFilePointerEx ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW FindClose

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_99268cf298b5143bb60bcbc49cbd5943_cobalt-strike_icedid_stealc

kernel32

generic