2026-08-15_b6f7049eaaae1b41779d68e3c7bc31b3_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_b6f7049eaaae1b41779d68e3c7bc31b3_cobalt-strike_icedid
Size 131KB
Sample260815-mshetsfc43
SHA256 727e8c839a0b5eb1d67282b7e323ecf51ac1b73ee0d81946abbbfce005f43210
MD5 b6f7049eaaae1b41779d68e3c7bc31b3
SHA1 2e776abca8445f2a3cc63066de167843497d6f3d
SHA512 8d6a349373cb229526b8d455ae31eb095bdabb6dfee6a1f7ba39f56ccabc8abdca3fead12d428d30ac39402ad10bdb974725d977e03fa7969bdc903535e6dd50
SSDEEP 3072:fEYvuYeweXlgl3ku3f+p9J6BFsK8DT+wOCwPnvUOC92e:M21eO3ku3WbJo/nvpx
TLSH
T151D36C57B3E530F8E1778579C4A1170AEB72B8721BA19BDF03A046651F232D09E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-15_b6f7049eaaae1b41779d68e3c7bc31b3_cobalt-strike_icedid

.exe 131KB

2026-08-15_b6f7049eaaae1b41779d68e3c7bc31b3_cobalt-strike_icedid

IMPHASH f366e3ff6f89564cc4f38c4e97cf13f9
SHA256 727e8c839a0b5eb1d67282b7e323ecf51ac1b73ee0d81946abbbfce005f43210
MD5 b6f7049eaaae1b41779d68e3c7bc31b3
SHA1 2e776abca8445f2a3cc63066de167843497d6f3d
SHA512 8d6a349373cb229526b8d455ae31eb095bdabb6dfee6a1f7ba39f56ccabc8abdca3fead12d428d30ac39402ad10bdb974725d977e03fa7969bdc903535e6dd50
SSDEEP 3072:fEYvuYeweXlgl3ku3f+p9J6BFsK8DT+wOCwPnvUOC92e:M21eO3ku3WbJo/nvpx
TLSH
T151D36C57B3E530F8E1778579C4A1170AEB72B8721BA19BDF03A046651F232D09E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

5f:dc:79:b1:33:ec:50:b8:67:75:d6:39:4a:7b:4c:52:3c:f4:a7:c1:c3:44:89:9e:6b:97:0f:b5:70:a6:ff:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:c1:a2:26:80:ab:e5:ed:39:c3:d6:76:63:fe:27:15

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\pl\output\srvstub.pdb

kernel32

SetEvent WaitForSingleObject CreateEventW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess TerminateProcess GetExitCodeProcess CreateThread ExitThread CreateProcessW GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetLastError InitializeCriticalSectionEx DeleteCriticalSection WriteConsoleW CreateFileW HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetStartupInfoW CloseHandle IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_b6f7049eaaae1b41779d68e3c7bc31b3_cobalt-strike_icedid

kernel32

advapi32

generic