2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid
Size 116KB
Sample260919-msdrmszanf
SHA256 c7862295b6030c3611a5dbc529dc1400a3fac2db077a89b02751f41debcd089b
MD5 a6a2554ebd335aa12dfa6db01ecc28e9
SHA1 7c4a94035a77c056c2c5edd77f6561c6812c3978
SHA512 ebd000d1f3f2f8bf880364b7ca92a0ba55bb417d62201e444a67eaf7468b0c3169257e0abe27b8cfb5fb6e1577eca24f7182db62aab048a58a244ca37befe545
SSDEEP 1536:odzNtRSNEp1+V2RMv0qwbfKsTHea71+wEjxUanxsWX5dq9dlE2dm4Jus8X+Vjn:8ksohwbfR+ax+wENUafaJm4JusB9n
TLSH
T139C34A57B3E131F8E1778A3988650A05E772B8760B319BEF0768465A1F236C19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid

File Explorer

2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid

.exe 116KB

2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid

IMPHASH ccfce802052f674f3ca31943d4645c19
SHA256 c7862295b6030c3611a5dbc529dc1400a3fac2db077a89b02751f41debcd089b
MD5 a6a2554ebd335aa12dfa6db01ecc28e9
SHA1 7c4a94035a77c056c2c5edd77f6561c6812c3978
SHA512 ebd000d1f3f2f8bf880364b7ca92a0ba55bb417d62201e444a67eaf7468b0c3169257e0abe27b8cfb5fb6e1577eca24f7182db62aab048a58a244ca37befe545
SSDEEP 1536:odzNtRSNEp1+V2RMv0qwbfKsTHea71+wEjxUanxsWX5dq9dlE2dm4Jus8X+Vjn:8ksohwbfR+ax+wENUafaJm4JusB9n
TLSH
T139C34A57B3E131F8E1778A3988650A05E772B8760B319BEF0768465A1F236C19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAlloc WaitForSingleObject Sleep LoadLibraryW GetProcAddress GetFileSize GetModuleHandleW FlushInstructionCache GetCurrentProcess CreateProcessW HeapFree SetFilePointer HeapAlloc GetWindowsDirectoryW GetProcessHeap WriteConsoleW GetConsoleMode VirtualFree VirtualProtect FlushFileBuffers GetDriveTypeW SetFilePointerEx CloseHandle CreateFileW FindClose WriteFile FindNextFileW GetFullPathNameW GetFileSizeEx FindFirstFileW ReadFile QueryPerformanceCounter GetModuleFileNameW GetConsoleOutputCP HeapReAlloc HeapSize LCMapStringW CompareStringW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx

user32

wsprintfW

advapi32

RegDeleteKeyW RegOpenKeyExW CreateServiceW CloseServiceHandle OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegDeleteTreeW RegSetValueExW OpenProcessToken GetTokenInformation CryptAcquireContextW CryptGenRandom CryptReleaseContext

shell32

ShellExecuteExW

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid

kernel32

user32

advapi32

shell32

bcrypt

generic