2026-10-20_4b73200b52e38197173048fe58b8f63d_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-20_4b73200b52e38197173048fe58b8f63d_cobalt-strike_icedid
Size 621KB
Sample261020-h46vcaev8v
SHA256 047a17541b2bdcc7e71e8950e0efafef2b8bf5240f0749afb1cc80252cc2cdf7
MD5 4b73200b52e38197173048fe58b8f63d
SHA1 fee2f6747994508121adba52c213d8f52b575cd7
SHA512 60143352c32882d260615aae04507c67f7d5c32118c75dbc209e4d686cb20b8e5bde758bcd9d9542da20779501b7b1a5c8debc926620cece859272f291afcdff
SSDEEP 6144:Ex7/f+yBAl3QWIjyXnhEh3Yb+YCih/yYOHhXqgrY6BZ9o7D8kniHfur:Ex7XHA3fXnhE3Yb+YlOSqy8s
TLSH
T114D43915B69628ACE556C970830689336B3670CF1B35AEFF01C842793FADAE45F39319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_4b73200b52e38197173048fe58b8f63d_cobalt-strike_icedid

File Explorer

2026-10-20_4b73200b52e38197173048fe58b8f63d_cobalt-strike_icedid

.exe 621KB

2026-10-20_4b73200b52e38197173048fe58b8f63d_cobalt-strike_icedid

IMPHASH f32d921da81437f480d79940553cf8ea
SHA256 047a17541b2bdcc7e71e8950e0efafef2b8bf5240f0749afb1cc80252cc2cdf7
MD5 4b73200b52e38197173048fe58b8f63d
SHA1 fee2f6747994508121adba52c213d8f52b575cd7
SHA512 60143352c32882d260615aae04507c67f7d5c32118c75dbc209e4d686cb20b8e5bde758bcd9d9542da20779501b7b1a5c8debc926620cece859272f291afcdff
SSDEEP 6144:Ex7/f+yBAl3QWIjyXnhEh3Yb+YCih/yYOHhXqgrY6BZ9o7D8kniHfur:Ex7XHA3fXnhE3Yb+YlOSqy8s
TLSH
T114D43915B69628ACE556C970830689336B3670CF1B35AEFF01C842793FADAE45F39319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

384144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RuntimeBroker.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

FreeEnvironmentStringsW WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW GetStdHandle GetCurrentProcess GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter GetCurrentProcessId FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx TerminateProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess WideCharToMultiByte WaitForSingleObjectEx GetProcAddress CreateMutexA ReleaseMutex GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep FlsFree FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue GetFileType FormatMessageW GetModuleHandleA QueryPerformanceFrequency SetStdHandle FindNextFileW GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile GetCommandLineA IsValidCodePage GetACP LoadLibraryW CreateToolhelp32Snapshot Process32First Process32Next GetLastError OpenProcess VirtualQueryEx GetSystemInfo ReadProcessMemory GetModuleHandleW CloseHandle CompareStringW LCMapStringW HeapSize LoadLibraryA VirtualProtect InitializeCriticalSectionEx FlsGetValue GetStringTypeW GetCPInfo GetOEMCP InitializeSListHead

user32

PostQuitMessage IsWindowVisible DefWindowProcW GetWindowRect GetWindowThreadProcessId SetLayeredWindowAttributes UnregisterClassW DestroyWindow CreateWindowExW RegisterClassExW GetWindowLongPtrW ReleaseDC GetDC SetWindowPos GetSystemMetrics EnumWindows

gdi32

TextOutW SetTextColor LineTo MoveToEx BitBlt SetBkMode GetStockObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC DeleteObject Rectangle PatBlt SelectObject CreatePen CreateSolidBrush GetPixel

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Name

.text

Size

452KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_4b73200b52e38197173048fe58b8f63d_cobalt-strike_icedid

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

gdi32

ntdll

generic