2026-10-10_3cd0e81d12ea45cf5a0a30d28e4daa8a_icedid

General

Target
2026-10-10_3cd0e81d12ea45cf5a0a30d28e4daa8a_icedid
Size 1.3MB
Sample261011-txrydstxbx
SHA256 c10416eb3050da5edfb1d6e2b00a4f744f66243ffc2ff9164c9b4a7794127c30
MD5 3cd0e81d12ea45cf5a0a30d28e4daa8a
SHA1 6129d9f345987d8b427f7f78c7e77864e95c24f1
SHA512 fa82d1214b9af0589f252c9c335f655709f39016fb0ec7ffb56b4cd5a2c33a5c0a612cad266d7bf2e8fa28cbf9bedf1581970c46dcca95fc1c99606c568db386
SSDEEP 24576:eQP7ymMfTYsyNsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:eSymMkwGxubdNNVdb9IPK
TLSH
T1BE55F161FA447FE8D166CD3C467685666D327C83073269DF22D072683E36AEB5E38E10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_3cd0e81d12ea45cf5a0a30d28e4daa8a_icedid

File Explorer

2026-10-10_3cd0e81d12ea45cf5a0a30d28e4daa8a_icedid

.exe 1.3MB

2026-10-10_3cd0e81d12ea45cf5a0a30d28e4daa8a_icedid

IMPHASH ac8572a0e8b1db8d8fa69dd4c7548511
SHA256 c10416eb3050da5edfb1d6e2b00a4f744f66243ffc2ff9164c9b4a7794127c30
MD5 3cd0e81d12ea45cf5a0a30d28e4daa8a
SHA1 6129d9f345987d8b427f7f78c7e77864e95c24f1
SHA512 fa82d1214b9af0589f252c9c335f655709f39016fb0ec7ffb56b4cd5a2c33a5c0a612cad266d7bf2e8fa28cbf9bedf1581970c46dcca95fc1c99606c568db386
SSDEEP 24576:eQP7ymMfTYsyNsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:eSymMkwGxubdNNVdb9IPK
TLSH
T1BE55F161FA447FE8D166CD3C467685666D327C83073269DF22D072683E36AEB5E38E10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

167936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

updater_launcher.pdb

kernel32

FindClose CloseHandle GetCommandLineW WaitForSingleObject FindFirstFileExW GetLastError CreateToolhelp32Snapshot GetCurrentProcessId Process32FirstW Process32NextW OpenProcess FindNextFileW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetModuleHandleW FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread GetFinalPathNameByHandleW SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW VirtualProtect QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile ExitProcess TerminateProcess GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsGetValue InitializeCriticalSectionEx

user32

MessageBoxW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtOpenFile NtReadFile

Name

.text

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

763KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_3cd0e81d12ea45cf5a0a30d28e4daa8a_icedid

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic