2026-10-16_e342acc7abfae7a4068da5df609fa35e_cobalt-strike_icedid

General

Target
2026-10-16_e342acc7abfae7a4068da5df609fa35e_cobalt-strike_icedid
Size 406KB
Sample261017-e8l4yssw6l
SHA256 61e55b9ca26bc3c32bbaed8090899d764c8b42053b2103ef020fef06eb2f9363
MD5 e342acc7abfae7a4068da5df609fa35e
SHA1 0da6ef5402daf9c019bfef3a8ede6168ab68cce2
SHA512 71130bc8245d61b6aa908f0924891a5f3eabc4c24157b4aeaa96f619155ea332167f4bc52f72399fc00d13805b60a7796e88244b99b2edbc61986ee7fba75fa6
SSDEEP 6144:/6ntwrz+TjpbT2+VGiJuS0/jKHliCjr0eD3Ozbw34l74RSHfXHlO0oHlw0m7jL:/6nQ+TFa4GMf50ejOzl74YXHlX0m
TLSH
T19394F05B63A934ECE536927880911E46EB72F87117218BBF17B0165A1F673E04E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_e342acc7abfae7a4068da5df609fa35e_cobalt-strike_icedid

File Explorer

2026-10-16_e342acc7abfae7a4068da5df609fa35e_cobalt-strike_icedid

.exe 406KB

2026-10-16_e342acc7abfae7a4068da5df609fa35e_cobalt-strike_icedid

IMPHASH 5a817a5343d67918603067ec9abf90e4
SHA256 61e55b9ca26bc3c32bbaed8090899d764c8b42053b2103ef020fef06eb2f9363
MD5 e342acc7abfae7a4068da5df609fa35e
SHA1 0da6ef5402daf9c019bfef3a8ede6168ab68cce2
SHA512 71130bc8245d61b6aa908f0924891a5f3eabc4c24157b4aeaa96f619155ea332167f4bc52f72399fc00d13805b60a7796e88244b99b2edbc61986ee7fba75fa6
SSDEEP 6144:/6ntwrz+TjpbT2+VGiJuS0/jKHliCjr0eD3Ozbw34l74RSHfXHlO0oHlw0m7jL:/6nQ+TFa4GMf50ejOzl74YXHlX0m
TLSH
T19394F05B63A934ECE536927880911E46EB72F87117218BBF17B0165A1F673E04E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetCursorPos

advapi32

RegOpenKeyExA RegCloseKey

kernel32

WriteConsoleW LoadLibraryExW GetCommandLineW GetEnvironmentVariableA GetTempPathA HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetSystemDirectoryA GetVersionExA VirtualAlloc VirtualProtect IsWow64Process GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA FindResourceA GetComputerNameA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW CloseHandle RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

Name

.text

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_e342acc7abfae7a4068da5df609fa35e_cobalt-strike_icedid

user32

advapi32

kernel32

generic