2026-08-04_c15a15b3a881320d4de0bed0c29f7b41_cobalt-strike_icedid_stealc

General

Target
2026-08-04_c15a15b3a881320d4de0bed0c29f7b41_cobalt-strike_icedid_stealc
Size 145KB
Sample260804-rl82esgl9y
SHA256 bf521b5108394be810e413a4548d37197cb142c3190d14ce526088a2a5e804c9
MD5 c15a15b3a881320d4de0bed0c29f7b41
SHA1 03529cac540b1b8d013d4ace675efa6a3f5c481d
SHA512 32b1f148eb5f3315d54444b6949af63247f27c5d3dd3db179678d294d113c3bcdcecd6d669cbf2c0021d8dee7b2473df201fd7aa359d56705800959ef2a7a326
SSDEEP 3072:k0isKysVhZbLY9rhrYcv4jJX1Z6jLoWU4U2jCAoIGq0f:+LhNLYw64jJraQYKJq0f
TLSH
T17DE35B5BB3A530F9E17B8139C8520A46E77278310B61ABDF03A447761F636E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_c15a15b3a881320d4de0bed0c29f7b41_cobalt-strike_icedid_stealc

File Explorer

2026-08-04_c15a15b3a881320d4de0bed0c29f7b41_cobalt-strike_icedid_stealc

.exe 145KB

2026-08-04_c15a15b3a881320d4de0bed0c29f7b41_cobalt-strike_icedid_stealc

IMPHASH 6b99150085dbb418562146fd06057d7b
SHA256 bf521b5108394be810e413a4548d37197cb142c3190d14ce526088a2a5e804c9
MD5 c15a15b3a881320d4de0bed0c29f7b41
SHA1 03529cac540b1b8d013d4ace675efa6a3f5c481d
SHA512 32b1f148eb5f3315d54444b6949af63247f27c5d3dd3db179678d294d113c3bcdcecd6d669cbf2c0021d8dee7b2473df201fd7aa359d56705800959ef2a7a326
SSDEEP 3072:k0isKysVhZbLY9rhrYcv4jJX1Z6jLoWU4U2jCAoIGq0f:+LhNLYw64jJraQYKJq0f
TLSH
T17DE35B5BB3A530F9E17B8139C8520A46E77278310B61ABDF03A447761F636E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

21588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable

user32

ShowWindow MessageBoxA

kernel32

WriteConsoleW CreateFileW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetCurrentProcess TerminateProcess SetErrorMode GetModuleHandleA CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle LoadLibraryW CreateThread GetProcAddress FreeLibrary WideCharToMultiByte GetConsoleWindow IsDebuggerPresent SetUnhandledExceptionFilter VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap IsBadReadPtr GetEnvironmentStringsW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW HeapReAlloc GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar

Name

.text

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_c15a15b3a881320d4de0bed0c29f7b41_cobalt-strike_icedid_stealc

winhttp

user32

kernel32

generic