2026-10-06_26e92973f429e6303692088e1ae7b35f_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_26e92973f429e6303692088e1ae7b35f_cobalt-strike_icedid
Size 786KB
Sample261006-r4ycms1tcs
SHA256 26bbb1a8c6b70aa8b3ce06dd3bd4431c11e16e2b217d469cbb5dc49013c30065
MD5 26e92973f429e6303692088e1ae7b35f
SHA1 6a01e57f991899d6efef02197f1c7f4e121b1b5f
SHA512 a63f8fca012a852e73210018409f465d83857ef0bcf9336d6e6c30aebeb13f1ad11687ca215cfa3082312e3585de7108c0963c9e68f1c8dc95a63d1ae2b22e56
SSDEEP 24576:iEHYf0ZMlEhVGPLzu9TVNXPEBqtZe7o1zymQNqq46GPibN3e:NHYQpzXzy25Pm3e
TLSH
T1A1057CEFD18AA3B0CEB68873E21B0571A71B9CBDD529543A34DD705B49B7F910E13822
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-06_26e92973f429e6303692088e1ae7b35f_cobalt-strike_icedid

.exe 786KB

2026-10-06_26e92973f429e6303692088e1ae7b35f_cobalt-strike_icedid

IMPHASH bb2e7e3fdc3065c882dcb8496850f960
SHA256 26bbb1a8c6b70aa8b3ce06dd3bd4431c11e16e2b217d469cbb5dc49013c30065
MD5 26e92973f429e6303692088e1ae7b35f
SHA1 6a01e57f991899d6efef02197f1c7f4e121b1b5f
SHA512 a63f8fca012a852e73210018409f465d83857ef0bcf9336d6e6c30aebeb13f1ad11687ca215cfa3082312e3585de7108c0963c9e68f1c8dc95a63d1ae2b22e56
SSDEEP 24576:iEHYf0ZMlEhVGPLzu9TVNXPEBqtZe7o1zymQNqq46GPibN3e:NHYQpzXzy25Pm3e
TLSH
T1A1057CEFD18AA3B0CEB68873E21B0571A71B9CBDD529543A34DD705B49B7F910E13822
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

66:be:af:9f:67:8b:83:e6:63:8d:61:64:3f:a2:e2:a1:25:ac:c7:be:1c:43:51:e6:ee:ce:45:98:6f:3a:6b:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 23, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:ca:73:6e:dd:e7:f8:99:25:91:c3:07:6a:dc:fb:6e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 8, 2026 - Apr 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

695946

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb

Name

.std

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.std

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.std

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.std

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.std

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.std

Size

552KB

Virtual Size

552KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.std

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.std

Size

512B

Virtual Size

135B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

2026-10-06_26e92973f429e6303692088e1ae7b35f_cobalt-strike_icedid

starbase

generic