2026-09-29_e98420b519f40922f01f9f1de370d177_cobalt-strike_icedid_stealc

General

Target
2026-09-29_e98420b519f40922f01f9f1de370d177_cobalt-strike_icedid_stealc
Size 530KB
Sample260929-rt2bjstvfw
SHA256 9fa53206f4554646d48339b820adb0330b7580c95c5c570f9f05e9246dc052f9
MD5 e98420b519f40922f01f9f1de370d177
SHA1 8d2a54a8772362920671c30f3d9663cb69e404a4
SHA512 ce0fb55f19b59eddf1e9efe04ef14c65b68f8e3b264b8302ae397c6bf33fea6ebe9d99266ca61d85df553d7829ad8c5199e20fb186b9831e06a85df68f430ec5
SSDEEP 12288:H0go0TdWfyXVl+yrXhA66ideeZ9kKlTZd+KqGU3uAIAWh905:UzQdWol+qt6iceetSAWw5
TLSH
T153B4CF19E6D047FCD278C07A8C59E8246E137E0326A29D7E6FDD81A68D5D5930F283E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_e98420b519f40922f01f9f1de370d177_cobalt-strike_icedid_stealc

File Explorer

2026-09-29_e98420b519f40922f01f9f1de370d177_cobalt-strike_icedid_stealc

.exe 530KB

2026-09-29_e98420b519f40922f01f9f1de370d177_cobalt-strike_icedid_stealc

IMPHASH b77917373f15d4029253dd5466f9d841
SHA256 9fa53206f4554646d48339b820adb0330b7580c95c5c570f9f05e9246dc052f9
MD5 e98420b519f40922f01f9f1de370d177
SHA1 8d2a54a8772362920671c30f3d9663cb69e404a4
SHA512 ce0fb55f19b59eddf1e9efe04ef14c65b68f8e3b264b8302ae397c6bf33fea6ebe9d99266ca61d85df553d7829ad8c5199e20fb186b9831e06a85df68f430ec5
SSDEEP 12288:H0go0TdWfyXVl+yrXhA66ideeZ9kKlTZd+KqGU3uAIAWh905:UzQdWol+qt6iceetSAWw5
TLSH
T153B4CF19E6D047FCD278C07A8C59E8246E137E0326A29D7E6FDD81A68D5D5930F283E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeleteFileA GetTempPathA CloseHandle Sleep CreateProcessA GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap FlushFileBuffers CreateFileW ReadFile ReadConsoleW HeapSize HeapReAlloc SetEndOfFile

Name

.text

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

442KB

Virtual Size

441KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_e98420b519f40922f01f9f1de370d177_cobalt-strike_icedid_stealc

kernel32

generic