2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc
Size 302KB
Sample260801-ddmlkawdpd
SHA256 6914166477c5813f0ca0543bbaf401cfb6f3cd230bd8e111739f0860ee6e37ad
MD5 9ebe90bba3f6cba9cd6410be4ccdd54f
SHA1 f3d785a04d6783cc4b5a9e93bae188e4802f7157
SHA512 2a4ff7db09109e37ae335e3e9c284f2b5c4febad8fbd2f68f7570bf1950863e2016ae8b4b309494a8b6cb578086a65419bce16fb6d023fb4e680990ef069553a
SSDEEP 6144:vQcfcTiIxIFXMNNhQAyA7GbqWvCNW/Ytoa:vrsiuIFENh3nWvEWgV
TLSH
T135647D12B6A51CF9E977C538C9524506DBB2BC464760EACF03A04E9A9F337D06E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc

File Explorer

2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc

.exe 302KB

2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc

IMPHASH e17576d99b4bddf7f314580d1735c10f
SHA256 6914166477c5813f0ca0543bbaf401cfb6f3cd230bd8e111739f0860ee6e37ad
MD5 9ebe90bba3f6cba9cd6410be4ccdd54f
SHA1 f3d785a04d6783cc4b5a9e93bae188e4802f7157
SHA512 2a4ff7db09109e37ae335e3e9c284f2b5c4febad8fbd2f68f7570bf1950863e2016ae8b4b309494a8b6cb578086a65419bce16fb6d023fb4e680990ef069553a
SSDEEP 6144:vQcfcTiIxIFXMNNhQAyA7GbqWvCNW/Ytoa:vrsiuIFENh3nWvEWgV
TLSH
T135647D12B6A51CF9E977C538C9524506DBB2BC464760EACF03A04E9A9F337D06E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47012

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader NtMapViewOfSection NtOpenSection NtCreateFile NtUnmapViewOfSection NtFsControlFile RtlInitUnicodeString NtQuerySystemInformation RtlUnwind

kernel32

CreateFileW GetProcAddress GetModuleHandleW WriteProcessMemory HeapFree GetCurrentThreadId HeapAlloc ReadProcessMemory GetCurrentProcessId GetProcessHeap OpenThread VirtualFree VirtualAlloc GetModuleHandleA GetFileSizeEx WriteFile SetFilePointerEx FlushFileBuffers GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadFile ExitProcess CloseHandle GetCurrentThread Wow64RevertWow64FsRedirection Sleep TerminateProcess Wow64DisableWow64FsRedirection GetCurrentProcess WriteConsoleW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetLastError AcquireSRWLockExclusive FlsFree FlsSetValue ReleaseSRWLockExclusive FlsGetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode FlsAlloc HeapSize

user32

CreateWindowExW MessageBoxW wsprintfW

advapi32

OpenProcessToken OpenThreadToken LookupPrivilegeValueW AdjustTokenPrivileges

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable

crypt32

CryptStringToBinaryA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc

ntdll

kernel32

user32

advapi32

winhttp

crypt32

generic