2026-08-16_ac81865b634d7e26c1b2567ea9d6cfaf_cobalt-strike_icedid_stealc

General

Target
2026-08-16_ac81865b634d7e26c1b2567ea9d6cfaf_cobalt-strike_icedid_stealc
Size 262KB
Sample260816-ehhnvaygre
SHA256 b14d6a71517c8b0a133e35bc7558b025512f07d964c91f0991ce3397dee803a6
MD5 ac81865b634d7e26c1b2567ea9d6cfaf
SHA1 0985af324d0993398cfcf91c70b655dd5609f741
SHA512 180a198e23f9eb2b7ce73572bae344ba337abaa53b8d238231898f81ffb5592384c1532cde9b4d7b81a4c445dcb99a7c95fe1fbc6abcbc1aedd8b9747c388cbb
SSDEEP 6144:zFf5BLxOJliYb66vxFgfuuoP1s7YepVg:H3OJ5b9v/gGuojaV
TLSH
T1EB447E59B7950CF9FD7B857DC9420909DA72BC4647A0EACF03904AA61F237E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_ac81865b634d7e26c1b2567ea9d6cfaf_cobalt-strike_icedid_stealc

File Explorer

2026-08-16_ac81865b634d7e26c1b2567ea9d6cfaf_cobalt-strike_icedid_stealc

.exe 262KB

2026-08-16_ac81865b634d7e26c1b2567ea9d6cfaf_cobalt-strike_icedid_stealc

IMPHASH a1f6d5fb8e50b1c88810455e34d87d3d
SHA256 b14d6a71517c8b0a133e35bc7558b025512f07d964c91f0991ce3397dee803a6
MD5 ac81865b634d7e26c1b2567ea9d6cfaf
SHA1 0985af324d0993398cfcf91c70b655dd5609f741
SHA512 180a198e23f9eb2b7ce73572bae344ba337abaa53b8d238231898f81ffb5592384c1532cde9b4d7b81a4c445dcb99a7c95fe1fbc6abcbc1aedd8b9747c388cbb
SSDEEP 6144:zFf5BLxOJliYb66vxFgfuuoP1s7YepVg:H3OJ5b9v/gGuojaV
TLSH
T1EB447E59B7950CF9FD7B857DC9420909DA72BC4647A0EACF03904AA61F237E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA GetModuleHandleW LoadLibraryW SetEndOfFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_ac81865b634d7e26c1b2567ea9d6cfaf_cobalt-strike_icedid_stealc

kernel32

generic