General
- Target 2026-10-22_00570746ef37440088dcd3efb177d6da_cobalt-strike_icedid_stealc
- Size 180KB
- Sample261024-3dtsbaex6q
- SHA256 3258c76a0a7361cd247f45caf8e86c90321f461a9ff84e67446e7e387c59ca37
- MD5 00570746ef37440088dcd3efb177d6da
- SHA1 7e1ab2def26a2bf20f698a38a2c0d5b8a697800c
- SHA512 d36fc8460322ca50fbf8acbc1ab5c45ec6d00b4baa693b9cdbebbab244a77103dff5f89abb7a7f5ab2c7d6133bc99daf40d694e6ccfb2460086c8a9d933c4612
- SSDEEP 3072:lN/MyacFbEx8a+YjGFXw1vjRU4hPNwfGPZ1nLrXjz:lN/bjbEx8gGtw1dWyV
- TLSH T18A047C1AA6A920FAE277C534C9524D02FB327CA647B1AA9F07904AF54F137E09F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Behavioral task
behavioral1
Sample
2026-10-22_00570746ef37440088dcd3efb177d6da_cobalt-strike_icedid_stealc.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_00570746ef37440088dcd3efb177d6da_cobalt-strike_icedid_stealc.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_00570746ef37440088dcd3efb177d6da_cobalt-strike_icedid_stealc
- Size 180KB
- SHA256 3258c76a0a7361cd247f45caf8e86c90321f461a9ff84e67446e7e387c59ca37
- MD5 00570746ef37440088dcd3efb177d6da
- SHA1 7e1ab2def26a2bf20f698a38a2c0d5b8a697800c
- SHA512 d36fc8460322ca50fbf8acbc1ab5c45ec6d00b4baa693b9cdbebbab244a77103dff5f89abb7a7f5ab2c7d6133bc99daf40d694e6ccfb2460086c8a9d933c4612
- SSDEEP 3072:lN/MyacFbEx8a+YjGFXw1vjRU4hPNwfGPZ1nLrXjz:lN/bjbEx8gGtw1dWyV
- TLSH T18A047C1AA6A920FAE277C534C9524D02FB327CA647B1AA9F07904AF54F137E09F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL