2026-10-22_8edbd5e8d6045fd6e74c76119fdb40be_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_8edbd5e8d6045fd6e74c76119fdb40be_cobalt-strike_icedid
Size 199KB
Sample261024-fpsm3axs7k
SHA256 942bc131501e5320ccf2f467606256e152bab79063ee2c16577e86e320b43f92
MD5 8edbd5e8d6045fd6e74c76119fdb40be
SHA1 c47ee6fdaee29cdac1a16dcf24f7bb33b75c6e86
SHA512 a840ad30ab56dde1a5f8ae94ce061d73f03092fda0a43f7575400be7f704b9d99ed88385a912bb342c6427cf8ac1e7a7f08f95944ed986ae779d1cc29bcfc252
SSDEEP 3072:64SiWZIX/pIX5rSqi0fvlRjOOYsOkkw/NmZmFdgvPJK9qqi:lSiWCPpk5r5vaO8kkJ8xQF
TLSH
T1B1147C6377E530E9D4A14639C8952211FBBBF4760BA14EEF1B61427B1F136E18C3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-22_8edbd5e8d6045fd6e74c76119fdb40be_cobalt-strike_icedid

File Explorer

2026-10-22_8edbd5e8d6045fd6e74c76119fdb40be_cobalt-strike_icedid

.exe 199KB

2026-10-22_8edbd5e8d6045fd6e74c76119fdb40be_cobalt-strike_icedid

IMPHASH 26d53a2d2d4e1192ec44586995bfc383
SHA256 942bc131501e5320ccf2f467606256e152bab79063ee2c16577e86e320b43f92
MD5 8edbd5e8d6045fd6e74c76119fdb40be
SHA1 c47ee6fdaee29cdac1a16dcf24f7bb33b75c6e86
SHA512 a840ad30ab56dde1a5f8ae94ce061d73f03092fda0a43f7575400be7f704b9d99ed88385a912bb342c6427cf8ac1e7a7f08f95944ed986ae779d1cc29bcfc252
SSDEEP 3072:64SiWZIX/pIX5rSqi0fvlRjOOYsOkkw/NmZmFdgvPJK9qqi:lSiWCPpk5r5vaO8kkJ8xQF
TLSH
T1B1147C6377E530E9D4A14639C8952211FBBBF4760BA14EEF1B61427B1F136E18C3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:7 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b4:6f:a7:60:68:27:96:70:23:5e:99:ba:fc:88:13:df:e6:b3:1b:b6:56:15:a2:22:6b:c2:07:b7:d6:3a:3b:2b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Crypter Sample

Chains

Oct 15, 2026

CN=Crypter Sample

Minor OS version

Major OS version

Entry point

32540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess ExitProcess CreateThread FlushInstructionCache GetTickCount64 GetSystemDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleHandleW GetProcAddress LoadResource LockResource Sleep FindResourceW LoadLibraryW WriteConsoleW WaitForSingleObject CloseHandle IsDebuggerPresent ReadFile SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetFileSize CreateFileW GetTempPathW SizeofResource QueryPerformanceCounter LCMapStringW CompareStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

advapi32

GetUserNameW RegQueryValueExW RegCloseKey

shell32

SHGetKnownFolderPath

user32

GetClientRect ReleaseDC GetSystemMenu GetDC MonitorFromWindow GetSystemMetrics GetDesktopWindow

gdi32

BitBlt GetStockObject DeleteDC DeleteObject

ole32

CoGetClassObject CoUninitialize

oleaut32

SysStringLen SysFreeString VariantClear

version

VerQueryValueW GetFileVersionInfoW

wininet

InternetCloseHandle

bcrypt

BCryptOpenAlgorithmProvider

shlwapi

PathCombineW StrStrIW

Name

.text

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.sdata$

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_8edbd5e8d6045fd6e74c76119fdb40be_cobalt-strike_icedid

PE Signature issue

kernel32

advapi32

shell32

user32

gdi32

ole32

oleaut32

version

wininet

bcrypt

shlwapi

generic