2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid

General

Target
2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid
Size 106KB
Sample260819-nwtspstand
SHA256 3f8145e80bd4da9b30099401ac16721571a79b6373b5b5cf4b325129e5d289ec
MD5 3eccb8e55a0d362cd85fe9cb98c3d256
SHA1 034f1e581edb6aa4ead0f4d5d3a3ec590517c279
SHA512 9e979780936f1ea4934b7ee15c53d64dd72cf13bf456429aff58d445ccb48d2ffef9e9cdc700dd4231cbe16923721db3b313c0aab8c2ed742f639d0cefb69012
SSDEEP 1536:h/4p/3GFlOBsXoRDn5PSejFTH33SqY0da2lhtt/Xi43S1sWads9dl3lcufsVF9:h1P4VPSepnNY0Y2ZtPZCYEVlcesJ
TLSH
T1E5B36B5B63A530FCE5BB8638C4911A45E772B83207619FEF03A486561F236D18E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid

File Explorer

2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid

.exe 106KB

2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid

IMPHASH 0c1a8ac3de14c9f03e383fb92e1b1adb
SHA256 3f8145e80bd4da9b30099401ac16721571a79b6373b5b5cf4b325129e5d289ec
MD5 3eccb8e55a0d362cd85fe9cb98c3d256
SHA1 034f1e581edb6aa4ead0f4d5d3a3ec590517c279
SHA512 9e979780936f1ea4934b7ee15c53d64dd72cf13bf456429aff58d445ccb48d2ffef9e9cdc700dd4231cbe16923721db3b313c0aab8c2ed742f639d0cefb69012
SSDEEP 1536:h/4p/3GFlOBsXoRDn5PSejFTH33SqY0da2lhtt/Xi43S1sWads9dl3lcufsVF9:h1P4VPSepnNY0Y2ZtPZCYEVlcesJ
TLSH
T1E5B36B5B63A530FCE5BB8638C4911A45E772B83207619FEF03A486561F236D18E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

QueueUserAPC ResumeThread CreateProcessW VirtualAllocEx VirtualProtectEx WriteProcessMemory QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW WriteConsoleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid

kernel32

generic