2026-08-19_d3ec7b31a9cb612f794bca782feaf088_cobalt-strike_icedid

General

Target
2026-08-19_d3ec7b31a9cb612f794bca782feaf088_cobalt-strike_icedid
Size 114KB
Sample260819-btrjcacd75
SHA256 85408797a7f74953e323bc6ad2f067746d2c703aa9f9d7f79c4434e9705b6409
MD5 d3ec7b31a9cb612f794bca782feaf088
SHA1 b930b82f83ba08e1a3a11be08b14a9287234781b
SHA512 06a08c35838bf2c70956aec56127d467bf34a9bc6423ff951bf4ddd699bd45ec14bce47d54e85181785e9bd613fa7c617da979ca82fa347e19d92dabe08be371
SSDEEP 1536:rFn3+YbBhrnbmsE4Ho5Q27HVSyVb5ujOPj/1wRO5sW3sdp9dl5GGk4uoG4kSjbIo:pTnrNpo/1L5ujC/1yOT2B7HDk8
TLSH
T1D0B36D58B6BD10BCE577C238C5A10A45D77278120B50ABEF17A4C2992F37BD68D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_d3ec7b31a9cb612f794bca782feaf088_cobalt-strike_icedid

File Explorer

2026-08-19_d3ec7b31a9cb612f794bca782feaf088_cobalt-strike_icedid

.exe 114KB

2026-08-19_d3ec7b31a9cb612f794bca782feaf088_cobalt-strike_icedid

IMPHASH 037ef0812c5a3b99215162368d397804
SHA256 85408797a7f74953e323bc6ad2f067746d2c703aa9f9d7f79c4434e9705b6409
MD5 d3ec7b31a9cb612f794bca782feaf088
SHA1 b930b82f83ba08e1a3a11be08b14a9287234781b
SHA512 06a08c35838bf2c70956aec56127d467bf34a9bc6423ff951bf4ddd699bd45ec14bce47d54e85181785e9bd613fa7c617da979ca82fa347e19d92dabe08be371
SSDEEP 1536:rFn3+YbBhrnbmsE4Ho5Q27HVSyVb5ujOPj/1wRO5sW3sdp9dl5GGk4uoG4kSjbIo:pTnrNpo/1L5ujC/1yOT2B7HDk8
TLSH
T1D0B36D58B6BD10BCE577C238C5A10A45D77278120B50ABEF17A4C2992F37BD68D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rohan\Desktop\process-shield-main\process-shield-main\dll\x64\Release\shield_hook.pdb

user32

GetMessageW DispatchMessageW TranslateMessage

kernel32

TlsSetValue WriteConsoleW CreateFileW GetProcessIdOfThread GetProcessId Thread32Next Thread32First OpenFileMappingW UnmapViewOfFile CreateToolhelp32Snapshot Sleep CloseHandle GetProcAddress GetModuleHandleW MapViewOfFile GetLastError HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect GetSystemInfo VirtualAlloc VirtualFree VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_d3ec7b31a9cb612f794bca782feaf088_cobalt-strike_icedid

user32

kernel32

generic