2026-07-23_dec873fd811d43f9860fcd33ab637ab4_cobalt-strike_icedid

Resubmissions

29/07/2026, 08:31

260729-ke8czszbme8

23/07/2026, 23:46

260723-3sksysdf4910

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_dec873fd811d43f9860fcd33ab637ab4_cobalt-strike_icedid
Size 123KB
Sample260723-3sksysdf49
SHA256 a9207d6ffcda9167486160d98dfa0f78e662d32c4b11715a39e23fbc5ce8599a
MD5 dec873fd811d43f9860fcd33ab637ab4
SHA1 0b97fd6596e885e44d60c1d3a318f2d2e85a9518
SHA512 3bdb411ceb599bafc8f8d2c7eb7c67fe6eff35f6f428a337962a038b30cea2b16ae18bc42d431db825d1832bb618b61699c7fcb276903a76d46f26e0c36e8bc3
SSDEEP 3072:jix6VCu5DR0byU3aIa5Q65cv1N4QLwHHAC1IXH5pT:Mp1bN3CQI41qQLgtsH5Z
TLSH
T129C34A4732AA30F8E1778639C4610A46E772B8710B619FEF07A4425A5F277D09E3DF62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_dec873fd811d43f9860fcd33ab637ab4_cobalt-strike_icedid

File Explorer

2026-07-23_dec873fd811d43f9860fcd33ab637ab4_cobalt-strike_icedid

.exe 123KB

2026-07-23_dec873fd811d43f9860fcd33ab637ab4_cobalt-strike_icedid

IMPHASH bf56a2b14a038f44866df63bc53d71c0
SHA256 a9207d6ffcda9167486160d98dfa0f78e662d32c4b11715a39e23fbc5ce8599a
MD5 dec873fd811d43f9860fcd33ab637ab4
SHA1 0b97fd6596e885e44d60c1d3a318f2d2e85a9518
SHA512 3bdb411ceb599bafc8f8d2c7eb7c67fe6eff35f6f428a337962a038b30cea2b16ae18bc42d431db825d1832bb618b61699c7fcb276903a76d46f26e0c36e8bc3
SSDEEP 3072:jix6VCu5DR0byU3aIa5Q65cv1N4QLwHHAC1IXH5pT:Mp1bN3CQI41qQLgtsH5Z
TLSH
T129C34A4732AA30F8E1778639C4610A46E772B8710B619FEF07A4425A5F277D09E3DF62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetOpenA HttpSendRequestA HttpOpenRequestA InternetReadFile InternetConnectA InternetCloseHandle InternetCrackUrlA

shell32

SHGetFolderPathA

advapi32

RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegCloseKey RegSetValueExA

user32

wsprintfA ShowWindow

kernel32

GetConsoleMode FlushFileBuffers HeapReAlloc SetFilePointerEx CreateFileW WriteConsoleW GetConsoleOutputCP HeapSize LCMapStringW CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile SetFileAttributesA WriteFile GetTempPathA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap CreateMutexA Sleep ExitProcess CreateProcessA GetLocalTime GetModuleFileNameA WinExec lstrcmpA lstrcmpiA lstrcpynA lstrcatA lstrlenA CopyFileA GetComputerNameW WideCharToMultiByte GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

Name

.text

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_dec873fd811d43f9860fcd33ab637ab4_cobalt-strike_icedid

wininet

shell32

advapi32

user32

kernel32

generic