2026-08-27_0c9a6e28c40f047132b568e3714a3bc1_cobalt-strike_icedid_stealc

General

Target
2026-08-27_0c9a6e28c40f047132b568e3714a3bc1_cobalt-strike_icedid_stealc
Size 342KB
Sample260827-24va4abc45
SHA256 b04b90b243a7a0e1d329b46d885a8107ec8683f53d517f4f5e81ddc3993bd263
MD5 0c9a6e28c40f047132b568e3714a3bc1
SHA1 93b81e018a6572b9905279ad915bd7b0f15121cb
SHA512 00f58b1e1115e9658dd2aac8869bdea08eff559181da8ac3082ff66d09d8ae1e14ff3b6f36c0df72e8eda2ac76ce181c7ba37b51c6864bcf2417fe2faa104ede
SSDEEP 6144:yHec6RhEpEJSosBFbG8cjNKtT/o4aOEsGekSznuw:kecpups3bG8SNKtTSOErej
TLSH
T1FA74084AFAA524F5D1FAC0388542691EFD7178A643706BCB67914A472F23BE4ED3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_0c9a6e28c40f047132b568e3714a3bc1_cobalt-strike_icedid_stealc

File Explorer

2026-08-27_0c9a6e28c40f047132b568e3714a3bc1_cobalt-strike_icedid_stealc

.exe 342KB

2026-08-27_0c9a6e28c40f047132b568e3714a3bc1_cobalt-strike_icedid_stealc

IMPHASH 5ca241708710b22730a11bc29750eea6
SHA256 b04b90b243a7a0e1d329b46d885a8107ec8683f53d517f4f5e81ddc3993bd263
MD5 0c9a6e28c40f047132b568e3714a3bc1
SHA1 93b81e018a6572b9905279ad915bd7b0f15121cb
SHA512 00f58b1e1115e9658dd2aac8869bdea08eff559181da8ac3082ff66d09d8ae1e14ff3b6f36c0df72e8eda2ac76ce181c7ba37b51c6864bcf2417fe2faa104ede
SSDEEP 6144:yHec6RhEpEJSosBFbG8cjNKtT/o4aOEsGekSznuw:kecpups3bG8SNKtTSOErej
TLSH
T1FA74084AFAA524F5D1FAC0388542691EFD7178A643706BCB67914A472F23BE4ED3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

130588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen

user32

GetMessageA RemoveClipboardFormatListener AddClipboardFormatListener EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage

kernel32

RtlCaptureContext WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetModuleHandleA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency CloseHandle Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WakeAllConditionVariable EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW RtlUnwind RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapReAlloc HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx

Name

.text

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_0c9a6e28c40f047132b568e3714a3bc1_cobalt-strike_icedid_stealc

winhttp

user32

kernel32

generic