2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc
Size 280KB
Sample260928-le22msaa59
SHA256 7df989268942cdecd5492c47ac4c81c5dc7f767c62c9449591b740e239946744
MD5 02d704a59f18440660197cab23026636
SHA1 746012ddf61e3404d7972a428872341fd71df718
SHA512 daa47461a13a70539135e4275f087eaa18f7a344d9a906d95139454ac12831f4607ef1cb906196b0717dbf34900ae06de8114e5bcec6f86725c6b1b04f565f42
SSDEEP 3072:vpdUJ+UBzROPIO0nr70gZTtqzMXTsxqs5g2YtAdHGddVQyO5wyD3dfADWXcSBQKM:+t2MXTs95OKmj3QmWNlN6
TLSH
T12A545C5AB6A518F5E8BBC03DC542650AF97278964360EBCB1B900E9B1F23BE0DD3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc

File Explorer

2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc

.exe 280KB

2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc

IMPHASH 7e574c68d444bd44e19d44ada8158a8d
SHA256 7df989268942cdecd5492c47ac4c81c5dc7f767c62c9449591b740e239946744
MD5 02d704a59f18440660197cab23026636
SHA1 746012ddf61e3404d7972a428872341fd71df718
SHA512 daa47461a13a70539135e4275f087eaa18f7a344d9a906d95139454ac12831f4607ef1cb906196b0717dbf34900ae06de8114e5bcec6f86725c6b1b04f565f42
SSDEEP 3072:vpdUJ+UBzROPIO0nr70gZTtqzMXTsxqs5g2YtAdHGddVQyO5wyD3dfADWXcSBQKM:+t2MXTs95OKmj3QmWNlN6
TLSH
T12A545C5AB6A518F5E8BBC03DC542650AF97278964360EBCB1B900E9B1F23BE0DD3D711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegDeleteTreeA CloseServiceHandle ControlService DeleteService OpenSCManagerA OpenServiceA

user32

GetDC GetSystemMetrics SetSysColors ReleaseDC SystemParametersInfoA mouse_event SetCursorPos

gdi32

SetDeviceGammaRamp SetPixel CreateSolidBrush SelectObject Rectangle LineTo GetPixel Ellipse CreatePen DeleteObject

kernel32

SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW WriteConsoleW SetEndOfFile HeapSize FreeEnvironmentStringsW CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA SetFilePointer SetFilePointerEx WriteFile Beep CloseHandle GetCurrentProcess ExitProcess TerminateProcess CreateThread OpenProcess GetTickCount64 VirtualProtect FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA MoveFileA CreateToolhelp32Snapshot Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameW GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx ReadConsoleW HeapReAlloc FindFirstFileExW FindNextFileW

ntdll

RtlUnwindEx RtlUnwind RtlPcToFileHeader

Name

.text

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc

advapi32

user32

gdi32

kernel32

ntdll

generic