2026-07-23_087607de6e3e27a9aed60085aaf314d6_cobalt-strike_hijackloader_icedid_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_087607de6e3e27a9aed60085aaf314d6_cobalt-strike_hijackloader_icedid_stealc
Size 2.5MB
Sample260724-bspy5ayzdv
SHA256 654e4fe39bf684ab9e01b77ade088a8d3234671438b82632bc20cb6645f18d12
MD5 087607de6e3e27a9aed60085aaf314d6
SHA1 ede41095e99090f46127d6aeb22fbb2a6714e1c3
SHA512 107a37d47f9b2125c40682e3192d1b856f90e7709028d0398d31765558f0aa3f93f857c57b4608df4b4a438875797c4a0d2991bcc42d479e33e7f0a1eb44493c
SSDEEP 24576:RuIEDq6glp/6J5XB+4wtfVwyWgtlkTRtZCPy1xk8U0Hvv8l4xJn2cWG:RuIEDAn/6hPw4DgfIvCP6W0xJn2cV
TLSH
T1C5C5C7FE8E7E53CAC1AEC5F0B57592C6B4107848A076A7C62BC0079D67275A0ECD72C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-23_087607de6e3e27a9aed60085aaf314d6_cobalt-strike_hijackloader_icedid_stealc

File Explorer

2026-07-23_087607de6e3e27a9aed60085aaf314d6_cobalt-strike_hijackloader_icedid_stealc

.exe 2.5MB

2026-07-23_087607de6e3e27a9aed60085aaf314d6_cobalt-strike_hijackloader_icedid_stealc

IMPHASH d2e0470311131c7472d37352b697b8e7
SHA256 654e4fe39bf684ab9e01b77ade088a8d3234671438b82632bc20cb6645f18d12
MD5 087607de6e3e27a9aed60085aaf314d6
SHA1 ede41095e99090f46127d6aeb22fbb2a6714e1c3
SHA512 107a37d47f9b2125c40682e3192d1b856f90e7709028d0398d31765558f0aa3f93f857c57b4608df4b4a438875797c4a0d2991bcc42d479e33e7f0a1eb44493c
SSDEEP 24576:RuIEDq6glp/6J5XB+4wtfVwyWgtlkTRtZCPy1xk8U0Hvv8l4xJn2cWG:RuIEDAn/6hPw4DgfIvCP6W0xJn2cV
TLSH
T1C5C5C7FE8E7E53CAC1AEC5F0B57592C6B4107848A076A7C62BC0079D67275A0ECD72C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

dc:0a:9b:59:a0:93:4e:48:01:46:8f:68:f5:50:11:2b:1f:2e:18:cd:1a:33:a3:e1:c7:d7:d5:f0:83:b7:3c:c1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Feb 4, 2024

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2020 - Feb 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1681312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle HeapAlloc HeapFree GetProcessHeap Sleep ExitProcess GetTickCount GetModuleFileNameW GetProcAddress LoadLibraryA lstrcmpiW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError GetCurrentProcess GetModuleFileNameA GetModuleHandleW GetModuleHandleA WriteConsoleW CreateFileW SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection TerminateProcess FreeLibrary GetModuleHandleExW GetStdHandle WriteFile IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapReAlloc VirtualProtect LoadLibraryExW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode

user32

GetMessageW TranslateMessage DispatchMessageW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_087607de6e3e27a9aed60085aaf314d6_cobalt-strike_hijackloader_icedid_stealc

PE Signature issue

kernel32

user32

generic