2026-08-23_c0c14251f87bfef258a378260252716f_cobalt-strike_icedid_stealc

General

Target
2026-08-23_c0c14251f87bfef258a378260252716f_cobalt-strike_icedid_stealc
Size 296KB
Sample260823-2fmlcawscy
SHA256 75108891f1918b892e67aff7fdbdc9489d231faf3f98b2662a8bb427d8070427
MD5 c0c14251f87bfef258a378260252716f
SHA1 7e6b846b990d70b7d7e4947e214869d057ae31da
SHA512 c0f317276b0e508ab9efe7899c3dc84be7691cae009007f4eefdad1e369301e9f4e06c16d9014754125ffdcce11b730340d29e09475ae829b2b16523b6c71d21
SSDEEP 6144:K2kZ64lnyKiBY6cDPeo/R1xdOfj+2ZwKV:h4pyKiBYnDPeoRdOLrw
TLSH
T112546C09E79171FCEA67C63C8C678805EB617C654371E6CF63A046962E23AD85E3FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_c0c14251f87bfef258a378260252716f_cobalt-strike_icedid_stealc

File Explorer

2026-08-23_c0c14251f87bfef258a378260252716f_cobalt-strike_icedid_stealc

.exe 296KB

2026-08-23_c0c14251f87bfef258a378260252716f_cobalt-strike_icedid_stealc

IMPHASH 9b8f5d360afbd4764377cff020cb5899
SHA256 75108891f1918b892e67aff7fdbdc9489d231faf3f98b2662a8bb427d8070427
MD5 c0c14251f87bfef258a378260252716f
SHA1 7e6b846b990d70b7d7e4947e214869d057ae31da
SHA512 c0f317276b0e508ab9efe7899c3dc84be7691cae009007f4eefdad1e369301e9f4e06c16d9014754125ffdcce11b730340d29e09475ae829b2b16523b6c71d21
SSDEEP 6144:K2kZ64lnyKiBY6cDPeo/R1xdOfj+2ZwKV:h4pyKiBYnDPeoRdOLrw
TLSH
T112546C09E79171FCEA67C63C8C678805EB617C654371E6CF63A046962E23AD85E3FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize

kernel32

EnterCriticalSection VirtualFree GetCurrentProcess VirtualAlloc TerminateProcess GetModuleFileNameW InitializeProcThreadAttributeList LeaveCriticalSection InitializeCriticalSection FindClose CreateFileW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar UpdateProcThreadAttribute Process32NextW Process32FirstW CloseHandle GetWindowsDirectoryA HeapAlloc GetProcAddress VirtualAllocEx GetFileSize GetProcessHeap CreateProcessW GetModuleHandleW WideCharToMultiByte GetCurrentThread GetSystemInfo VirtualFreeEx GetEnvironmentVariableW GetWindowsDirectoryW Wow64DisableWow64FsRedirection UnmapViewOfFile Wow64RevertWow64FsRedirection GetNativeSystemInfo ReleaseActCtx IsWow64Process GetTempPathW LoadLibraryW WriteFile DeleteFileW CreateFileMappingW MapViewOfFile FreeLibrary GetConsoleOutputCP FlushFileBuffers SetFilePointerEx SetStdHandle ReadFile DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx GetConsoleMode WriteConsoleW FreeEnvironmentStringsW GetStringTypeW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW

advapi32

LookupPrivilegeValueW RegCloseKey RegOpenKeyExW OpenThreadToken RegQueryValueExW AdjustTokenPrivileges OpenProcessToken

oleaut32

SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_c0c14251f87bfef258a378260252716f_cobalt-strike_icedid_stealc

ole32

kernel32

advapi32

oleaut32

generic