2026-10-20_3b8a30be79a304c89c67b2e536f012fc_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-20_3b8a30be79a304c89c67b2e536f012fc_cobalt-strike_icedid
Size 641KB
Sample261020-jmxqsaa12r
SHA256 0da47c9f28da62281a8cc249bf045e4feaec563de66de2508c161bba7f9f0c7b
MD5 3b8a30be79a304c89c67b2e536f012fc
SHA1 46c90e136e8c48738449f65a1b73bbd7921814c7
SHA512 318ecc1d8a61446e54e9899ab8e9a80c78243611d08b8793dd45adba46bba797eda55fdefca412b87b8ef434efaa2a07c10061a08a9d5feeb9cad3e8cfa69d97
SSDEEP 6144:VF8ghwVZ1Qn8V/ziQq6n5rqWFqG1ZQ0fY682pqAtRZb3Pz8f7SQTdhAujamPSrU8:VFe/1Qni/zin6n5rkIvt8f7y02R7
TLSH
T138D42825B69668ACE556C970830689336B3530CF0B36ADFF02C442793FADAE55F39319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_3b8a30be79a304c89c67b2e536f012fc_cobalt-strike_icedid

File Explorer

2026-10-20_3b8a30be79a304c89c67b2e536f012fc_cobalt-strike_icedid

.exe 641KB

2026-10-20_3b8a30be79a304c89c67b2e536f012fc_cobalt-strike_icedid

IMPHASH fe163b5ef9720223e045488a54c0f506
SHA256 0da47c9f28da62281a8cc249bf045e4feaec563de66de2508c161bba7f9f0c7b
MD5 3b8a30be79a304c89c67b2e536f012fc
SHA1 46c90e136e8c48738449f65a1b73bbd7921814c7
SHA512 318ecc1d8a61446e54e9899ab8e9a80c78243611d08b8793dd45adba46bba797eda55fdefca412b87b8ef434efaa2a07c10061a08a9d5feeb9cad3e8cfa69d97
SSDEEP 6144:VF8ghwVZ1Qn8V/ziQq6n5rqWFqG1ZQ0fY682pqAtRZb3Pz8f7SQTdhAujamPSrU8:VFe/1Qni/zin6n5rkIvt8f7y02R7
TLSH
T138D42825B69668ACE556C970830689336B3530CF0B36ADFF02C442793FADAE55F39319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

396880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RuntimeBroker.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

FreeEnvironmentStringsW WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW GetStdHandle GetCurrentProcess GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread GetCurrentProcessId FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx TerminateProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess WideCharToMultiByte WaitForSingleObjectEx GetProcAddress CreateMutexA ReleaseMutex GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep FlsFree FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue GetFileType FormatMessageW GetModuleHandleA QueryPerformanceFrequency SetStdHandle FindNextFileW GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile GetCommandLineA IsValidCodePage GetACP LoadLibraryW GetLastError Process32Next Process32First CreateToolhelp32Snapshot OpenProcess VirtualQueryEx GetSystemInfo ReadProcessMemory GetModuleHandleW CloseHandle CompareStringW LCMapStringW HeapSize LoadLibraryA VirtualProtect InitializeCriticalSectionEx FlsGetValue GetStringTypeW GetCPInfo GetOEMCP InitializeSListHead

user32

DispatchMessageW PostQuitMessage IsWindowVisible DefWindowProcW GetWindowRect GetMessageW GetWindowDisplayAffinity TranslateMessage UpdateLayeredWindow GetWindowLongPtrW GetSystemMetrics EnumWindows UnregisterClassW DestroyWindow GetDC ReleaseDC SetLayeredWindowAttributes SetWindowPos CreateWindowExW RegisterClassExW SetWindowDisplayAffinity GetWindowThreadProcessId

gdi32

TextOutW SetTextColor LineTo MoveToEx SetBkMode GetStockObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC DeleteObject Rectangle PatBlt SelectObject GetPixel CreatePen CreateSolidBrush

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Name

.text

Size

464KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_3b8a30be79a304c89c67b2e536f012fc_cobalt-strike_icedid

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

gdi32

ntdll

generic