General
- Target 2026-08-20_1a3883e61bf62d7b10e4f7f11168b1cb_cobalt-strike_icedid_stealc
- Size 282KB
- Sample260820-qext5scr51
- SHA256 8a4a822981d593b2be7168bcb9294cb34826b8130ae1c22fb5241855a0756e25
- MD5 1a3883e61bf62d7b10e4f7f11168b1cb
- SHA1 43e6c236584c1e8a17c1da6fda406d20abb84672
- SHA512 b8fa44dffe6ec28d19caab24cd88e6b5e5d3445b78c15e957ddeace5b1d91ebe2b1790d97faa483d561b8f90096f730ea99e12d0c7ea1deb2acc78b8803df2fb
- SSDEEP 3072:eB5RnnHflOipIAV/Y3BRRIFkqscbLmtHclybgu8jR4T/NsHVCg0TjUp8FUMfQZ67:ejRQ5cbLmtHcljuKRM6OjU8FZmx
- TLSH T1EA543A0ABBA524F5E9BBC03DC942550AF97178A24770EBCB57904A971F23BE0AD3D701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-20_1a3883e61bf62d7b10e4f7f11168b1cb_cobalt-strike_icedid_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_1a3883e61bf62d7b10e4f7f11168b1cb_cobalt-strike_icedid_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_1a3883e61bf62d7b10e4f7f11168b1cb_cobalt-strike_icedid_stealc
- Size 282KB
- SHA256 8a4a822981d593b2be7168bcb9294cb34826b8130ae1c22fb5241855a0756e25
- MD5 1a3883e61bf62d7b10e4f7f11168b1cb
- SHA1 43e6c236584c1e8a17c1da6fda406d20abb84672
- SHA512 b8fa44dffe6ec28d19caab24cd88e6b5e5d3445b78c15e957ddeace5b1d91ebe2b1790d97faa483d561b8f90096f730ea99e12d0c7ea1deb2acc78b8803df2fb
- SSDEEP 3072:eB5RnnHflOipIAV/Y3BRRIFkqscbLmtHclybgu8jR4T/NsHVCg0TjUp8FUMfQZ67:ejRQ5cbLmtHcljuKRM6OjU8FZmx
- TLSH T1EA543A0ABBA524F5E9BBC03DC942550AF97178A24770EBCB57904A971F23BE0AD3D701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.