Overview

overview

10

Static

static

10

2026-10-23...id.exe

windows10-2004-x64

10

2026-10-23...id.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid
  • Size 1.6MB
  • Sample261023-mkl32scf49
  • SHA256 8890ae3c28d6d9a29150d61661bca21170025c92a03e6ba6ab94c297c8b30f48
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
d4faab834f3a2625be81ca35628d47baloader2cloader

Malware Config

Extracted

Family

  • 2cloader

Botnet

  • d4faab834f3a2625be81ca35628d47ba

C2

  • https://aware-cr1.com/api/beacon

Attributes
  • build_time

    2026-08-03T09:21:10Z

  • inject_target

    dllhost.exe

  • options

    ppid_spoof

    api_hooks

  • payload_name

    default.exe

Signatures

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid
    .exe 1.6MB

2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid

  • IMPHASH 905d6e2fd95bb9d68bb959ec7e8cfb12
  • SHA256 8890ae3c28d6d9a29150d61661bca21170025c92a03e6ba6ab94c297c8b30f48
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx64arch:x64

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
30400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths