2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid
Size 131KB
Sample260925-vsdewas18m
SHA256 ac36dd812caa36a0d5084929a9bfbcd5905adc9743a29c835e79967d75f7ec14
MD5 f47fce9a6453cdda65ec6f60718bd068
SHA1 ee4cd17e2390dd4e279d63a0415a0c86cb7a05db
SHA512 635fc691c4751ea583ccbdbd9147388aef7b3f5bcbd94150cfc29874a5e2f04fa8479e91154312a5716c032f6b4e8876375b08826f28fafc5c7db579e8feb47a
SSDEEP 3072:REYvuYeweXlgl3ku3f+p9J6BFs0tDT+wOCwPnvUOaK2cH:221eO3ku3WbJr/nvpIcH
TLSH
T1C1D37D57B3E530F8E1778179C4A1170AEB72B8721BA09BDF07A046652F236D09E3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid

.exe 131KB

2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid

IMPHASH f366e3ff6f89564cc4f38c4e97cf13f9
SHA256 ac36dd812caa36a0d5084929a9bfbcd5905adc9743a29c835e79967d75f7ec14
MD5 f47fce9a6453cdda65ec6f60718bd068
SHA1 ee4cd17e2390dd4e279d63a0415a0c86cb7a05db
SHA512 635fc691c4751ea583ccbdbd9147388aef7b3f5bcbd94150cfc29874a5e2f04fa8479e91154312a5716c032f6b4e8876375b08826f28fafc5c7db579e8feb47a
SSDEEP 3072:REYvuYeweXlgl3ku3f+p9J6BFs0tDT+wOCwPnvUOaK2cH:221eO3ku3WbJr/nvpIcH
TLSH
T1C1D37D57B3E530F8E1778179C4A1170AEB72B8721BA09BDF07A046652F236D09E3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d5:fa:78:49:7d:95:40:3d:70:63:e0:5e:3d:64:8a:f4:5b:a0:85:77:22:51:7b:5a:4c:a9:de:de:a0:5f:94:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:c1:a2:26:80:ab:e5:ed:39:c3:d6:76:63:fe:27:15

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\pl\output\srvstub.pdb

kernel32

SetEvent WaitForSingleObject CreateEventW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess TerminateProcess GetExitCodeProcess CreateThread ExitThread CreateProcessW GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetLastError InitializeCriticalSectionEx DeleteCriticalSection WriteConsoleW CreateFileW HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetStartupInfoW CloseHandle IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid

kernel32

advapi32

generic