2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid

General

Target
2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid
Size 112KB
Sample260804-qs3bsafp8x
SHA256 e4a08c61655f32c1885cbb15f74d3fb4e439e44c3bec7d7886d439d22cc4ca14
MD5 f0ab2f8f4108bd996e1e6246cfb802d9
SHA1 374426fb086164041659f8ba441a2c98309e864a
SHA512 a6c279768ed9aa45d594228a0adaeac14fd5684538eee82a2258beee6cc037880bae8e44b75d4dc6f9a830f634cfc5d63d888491d2e70adde6b4313646883faa
SSDEEP 3072:IZQuZiq6Krbt/0AtFcO+2jDIV5+iFjW5:Du8xKn1FcrFj
TLSH
T173B38CC3BBB1B6D9E06E9BBBDB7A8C41572DECBA18117F3E1A4451049E941C18F68C31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid

File Explorer

2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid

.exe 112KB

2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid

IMPHASH 00cdd05027a17c13455ec51de1eb7325
SHA256 e4a08c61655f32c1885cbb15f74d3fb4e439e44c3bec7d7886d439d22cc4ca14
MD5 f0ab2f8f4108bd996e1e6246cfb802d9
SHA1 374426fb086164041659f8ba441a2c98309e864a
SHA512 a6c279768ed9aa45d594228a0adaeac14fd5684538eee82a2258beee6cc037880bae8e44b75d4dc6f9a830f634cfc5d63d888491d2e70adde6b4313646883faa
SSDEEP 3072:IZQuZiq6Krbt/0AtFcO+2jDIV5+iFjW5:Du8xKn1FcrFj
TLSH
T173B38CC3BBB1B6D9E06E9BBBDB7A8C41572DECBA18117F3E1A4451049E941C18F68C31
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

65392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapFree WriteFile Sleep GetTempPathA CreateFileA CloseHandle HeapAlloc GetProcessHeap CreateProcessA WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW HeapSize

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen

Name

.text

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid

kernel32

winhttp

generic