2026-10-21_6c859352809d121ee23ea88494067ff5_cobalt-strike_icedid_stealc

General

Target
2026-10-21_6c859352809d121ee23ea88494067ff5_cobalt-strike_icedid_stealc
Size 144KB
Sample261022-2jfbfays8r
SHA256 6a5ad8de5775da26ae32db2d284ab31ad56f5341b090a52d511c48ee6a674a0d
MD5 6c859352809d121ee23ea88494067ff5
SHA1 ad50e55705834a31fa6698d4640f8cfa5b9f2772
SHA512 bd67daf1f611abe7cd8635dc7c915b28cf8a40aef7e2b3ee320f7b483759cd9d2af87c336550a7b1082a55919829c44081ef95059e2e0f2310be242982b4ea84
SSDEEP 3072:Neb4dml1bbl/pLrp6Xpju/H8/Kzf/vjOm9Dwx3:Eb4dm/bBpLrU5jwZZw3
TLSH
T10CE34B1BF6A570FAD17B8674C9420945EB72BCB55BA1ABDF03500AB50E23AD08F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_6c859352809d121ee23ea88494067ff5_cobalt-strike_icedid_stealc

File Explorer

2026-10-21_6c859352809d121ee23ea88494067ff5_cobalt-strike_icedid_stealc

.exe 144KB

2026-10-21_6c859352809d121ee23ea88494067ff5_cobalt-strike_icedid_stealc

IMPHASH 28d0225aa658c3f1127584d94403a42f
SHA256 6a5ad8de5775da26ae32db2d284ab31ad56f5341b090a52d511c48ee6a674a0d
MD5 6c859352809d121ee23ea88494067ff5
SHA1 ad50e55705834a31fa6698d4640f8cfa5b9f2772
SHA512 bd67daf1f611abe7cd8635dc7c915b28cf8a40aef7e2b3ee320f7b483759cd9d2af87c336550a7b1082a55919829c44081ef95059e2e0f2310be242982b4ea84
SSDEEP 3072:Neb4dml1bbl/pLrp6Xpju/H8/Kzf/vjOm9Dwx3:Eb4dm/bBpLrU5jwZZw3
TLSH
T10CE34B1BF6A570FAD17B8674C9420945EB72BCB55BA1ABDF03500AB50E23AD08F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

processstarter.pdb

kernel32

GetEnvironmentVariableW CloseHandle GetLastError WaitForSingleObject CreateProcessW GetModuleFileNameW LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileExW FindNextFileW AreFileApisANSI GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCPInfo GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_6c859352809d121ee23ea88494067ff5_cobalt-strike_icedid_stealc

kernel32

generic