General
- Target 2026-10-22_a65e1890cf299db9138c75abe885f40f_cobalt-strike_icedid_stealc
- Size 376KB
- Sample261024-b7d56se141
- SHA256 9e4729d59cd11bb6f7a5837675a86b6bc7e374bcf0abbc0234d4be99f4477abb
- MD5 a65e1890cf299db9138c75abe885f40f
- SHA1 ed1016b9a8758a25378c716ec35d2064f30e55fc
- SHA512 dc0c25cb530cc1b2543fe58bb111cbc49b750bd49f1074bd0d946ef598923fc7d8e71a7b821400aeb8696c47550e07e2b05ea114c2920f638d913681b552a129
- SSDEEP 6144:O3Fbb86AlbWPqI5LyR6jGfblIIof00D1xnBOxgHQDMyZovImylhEKhqdr39kLGd:O39lAivByRsGfofjfnUxg0MDvImy3Ehu
- TLSH T11684E055F7A110F8E0B3D27885A24A06DB72789E1761EEEF076C46861F232E45E3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-22_a65e1890cf299db9138c75abe885f40f_cobalt-strike_icedid_stealc.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_a65e1890cf299db9138c75abe885f40f_cobalt-strike_icedid_stealc.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_a65e1890cf299db9138c75abe885f40f_cobalt-strike_icedid_stealc
- Size 376KB
- SHA256 9e4729d59cd11bb6f7a5837675a86b6bc7e374bcf0abbc0234d4be99f4477abb
- MD5 a65e1890cf299db9138c75abe885f40f
- SHA1 ed1016b9a8758a25378c716ec35d2064f30e55fc
- SHA512 dc0c25cb530cc1b2543fe58bb111cbc49b750bd49f1074bd0d946ef598923fc7d8e71a7b821400aeb8696c47550e07e2b05ea114c2920f638d913681b552a129
- SSDEEP 6144:O3Fbb86AlbWPqI5LyR6jGfblIIof00D1xnBOxgHQDMyZovImylhEKhqdr39kLGd:O39lAivByRsGfofjfnUxg0MDvImy3Ehu
- TLSH T11684E055F7A110F8E0B3D27885A24A06DB72789E1761EEEF076C46861F232E45E3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing combination of virtualization drivers
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application