General
- Target 2026-08-20_a5cf5da459cd36ff3e82ab4d2e973dca_cobalt-strike_icedid_stealc
- Size 262KB
- Sample260820-ntdcyawclh
- SHA256 dd3a734a6cd9ad84af7c4579bdb37366a74e04c62241216e8c82a7f64f3e80ff
- MD5 a5cf5da459cd36ff3e82ab4d2e973dca
- SHA1 c1f60b2f10faefe287ef1d2802b3ea7129c2a291
- SHA512 ca6a1b9f8ee11c816801916d9f48bd55dd13ab614febeb43b1f086af220763575ae90d7d708bd4814f68b045fb6e739b3d8d47139b1d053ef2aeb7a24d5f5bf8
- SSDEEP 3072:4ZdMjpVIhmvWsy69wr/1s6FplArPxhjWvY8rbW/dBNthtCaZOuz4JgaSs+ORSHdM:4Zs9hjWgKQPquyep
- TLSH T1D4442A4ABAA518F5DDBBC03DC942250AF9B178964770EBCB57904A970F23BE0AD3D701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-20_a5cf5da459cd36ff3e82ab4d2e973dca_cobalt-strike_icedid_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_a5cf5da459cd36ff3e82ab4d2e973dca_cobalt-strike_icedid_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_a5cf5da459cd36ff3e82ab4d2e973dca_cobalt-strike_icedid_stealc
- Size 262KB
- SHA256 dd3a734a6cd9ad84af7c4579bdb37366a74e04c62241216e8c82a7f64f3e80ff
- MD5 a5cf5da459cd36ff3e82ab4d2e973dca
- SHA1 c1f60b2f10faefe287ef1d2802b3ea7129c2a291
- SHA512 ca6a1b9f8ee11c816801916d9f48bd55dd13ab614febeb43b1f086af220763575ae90d7d708bd4814f68b045fb6e739b3d8d47139b1d053ef2aeb7a24d5f5bf8
- SSDEEP 3072:4ZdMjpVIhmvWsy69wr/1s6FplArPxhjWvY8rbW/dBNthtCaZOuz4JgaSs+ORSHdM:4Zs9hjWgKQPquyep
- TLSH T1D4442A4ABAA518F5DDBBC03DC942250AF9B178964770EBCB57904A970F23BE0AD3D701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.