2026-10-28_9c651b473f7d5570274701808a72bbc6_cobalt-strike_icedid_stealc

General

Target
2026-10-28_9c651b473f7d5570274701808a72bbc6_cobalt-strike_icedid_stealc
Size 253KB
Sample261029-2md8jsfv2v
SHA256 f0a293b1aa9efa6429e1f89e27dab942082f92d04acf477791faa96795f4c82b
MD5 9c651b473f7d5570274701808a72bbc6
SHA1 159c136b5f2a12772ddf59670b20de24f478ea58
SHA512 18a28f556d128b1f8131768ef048b8f32f8696d704b726467b3c4bcf149127c2f63fa4bd46ffeed136b72e007d051e312f3741c94f12716a292220ecdf229a41
SSDEEP 6144:bOfEIQCxSGlhrV0ckrg/m8UbRZw2aQb0usz:bLtG5/k8NkR97b0R
TLSH
T129445C1976A40CF9FD6B953DCD524905EB72BC4647A0E6CF13A00A961F23BE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_9c651b473f7d5570274701808a72bbc6_cobalt-strike_icedid_stealc

File Explorer

2026-10-28_9c651b473f7d5570274701808a72bbc6_cobalt-strike_icedid_stealc

.exe 253KB

2026-10-28_9c651b473f7d5570274701808a72bbc6_cobalt-strike_icedid_stealc

IMPHASH dc6b41861f61c321810a204c41ca1189
SHA256 f0a293b1aa9efa6429e1f89e27dab942082f92d04acf477791faa96795f4c82b
MD5 9c651b473f7d5570274701808a72bbc6
SHA1 159c136b5f2a12772ddf59670b20de24f478ea58
SHA512 18a28f556d128b1f8131768ef048b8f32f8696d704b726467b3c4bcf149127c2f63fa4bd46ffeed136b72e007d051e312f3741c94f12716a292220ecdf229a41
SSDEEP 6144:bOfEIQCxSGlhrV0ckrg/m8UbRZw2aQb0usz:bLtG5/k8NkR97b0R
TLSH
T129445C1976A40CF9FD6B953DCD524905EB72BC4647A0E6CF13A00A961F23BE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW WriteConsoleW WideCharToMultiByte GetLastError HeapSize QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap RtlUnwind

user32

EnumDisplaySettingsW

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey GetUserNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_9c651b473f7d5570274701808a72bbc6_cobalt-strike_icedid_stealc

kernel32

user32

advapi32

generic