2026-09-28_dea9d735cb6b96a67596c24dc58326df_cobalt-strike_icedid_stealc

General

Target
2026-09-28_dea9d735cb6b96a67596c24dc58326df_cobalt-strike_icedid_stealc
Size 304KB
Sample260928-nbb26ascnd
SHA256 df8707a8e263f3aeb655f4b3f6ae8dcaac1e306b536911455c241bdb93b2142c
MD5 dea9d735cb6b96a67596c24dc58326df
SHA1 a34f914240194f187cdcec3d15cb2bd4d7550434
SHA512 6b9411162b0deba2d3584f4a17735d5b9952ba6c07a80a22ec2de6f1f9eabd9fb7d2ab49f5c8253e537f81bb6b3e2e21d7fff1e36907f34bbf5d5afaea51d6f3
SSDEEP 3072:RxKwnkJLtXGWYcKtpYCn6ycaTJayhAPUGxVPd+PVsMN6O8kwpa6DsDSrIHKrRBqC:p05sR/hAPUG38PmugF+wVtv0C
TLSH
T1BE64080BBAA521F5D9BAC03CC582651EFDB174A24370A7CB57914A972F23BE4AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_dea9d735cb6b96a67596c24dc58326df_cobalt-strike_icedid_stealc

File Explorer

2026-09-28_dea9d735cb6b96a67596c24dc58326df_cobalt-strike_icedid_stealc

.exe 304KB

2026-09-28_dea9d735cb6b96a67596c24dc58326df_cobalt-strike_icedid_stealc

IMPHASH 233d206e3963a2d14a233a846c29d52f
SHA256 df8707a8e263f3aeb655f4b3f6ae8dcaac1e306b536911455c241bdb93b2142c
MD5 dea9d735cb6b96a67596c24dc58326df
SHA1 a34f914240194f187cdcec3d15cb2bd4d7550434
SHA512 6b9411162b0deba2d3584f4a17735d5b9952ba6c07a80a22ec2de6f1f9eabd9fb7d2ab49f5c8253e537f81bb6b3e2e21d7fff1e36907f34bbf5d5afaea51d6f3
SSDEEP 3072:RxKwnkJLtXGWYcKtpYCn6ycaTJayhAPUGxVPd+PVsMN6O8kwpa6DsDSrIHKrRBqC:p05sR/hAPUG38PmugF+wVtv0C
TLSH
T1BE64080BBAA521F5D9BAC03CC582651EFDB174A24370A7CB57914A972F23BE4AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

97924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt

shell32

ShellExecuteW

user32

MessageBoxW

kernel32

SetEndOfFile WriteConsoleW HeapSize GetProcessHeap CreateFileW CloseHandle GetLastError GetOverlappedResult ResetEvent WaitForSingleObject CreateMutexW CreateEventW Sleep GetModuleFileNameW MoveFileW ReadDirectoryChangesW LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW SetStdHandle RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

Name

.text

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_dea9d735cb6b96a67596c24dc58326df_cobalt-strike_icedid_stealc

advapi32

shell32

user32

kernel32

generic