2026-10-28_6f9b20515905c79dbbb2df72c27a805c_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_6f9b20515905c79dbbb2df72c27a805c_cobalt-strike_icedid
Size 337KB
Sample261030-cskvvavwdv
SHA256 836554a2ec223159df425d8c71292fef20ef7659469dd83bab840e80af81f5cc
MD5 6f9b20515905c79dbbb2df72c27a805c
SHA1 d2ab0c947f05a6ddf442c81356fe24be96fc7b1a
SHA512 c4d096ef04c25d164285276d27dfa6d4e5942c88bb5adaf415564ffcdd18ad647af4367c455a27a0ad89cc3feafb7f39094a5278dff3c7f24f08cd166d0731bd
SSDEEP 6144:wFZeYfcg8xMWy5hI8OsGMCySrJIT1kdRehyIHq27D:Gpfc52Wy7IlrJnMo3ED
TLSH
T14B746D12B79655F9E957C0788246C673AA3378C60B21B9FF119442393F2BAE16F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-28_6f9b20515905c79dbbb2df72c27a805c_cobalt-strike_icedid

.exe 337KB

2026-10-28_6f9b20515905c79dbbb2df72c27a805c_cobalt-strike_icedid

IMPHASH 3b91d510d2d4a9761dc02eef38a52b5c
SHA256 836554a2ec223159df425d8c71292fef20ef7659469dd83bab840e80af81f5cc
MD5 6f9b20515905c79dbbb2df72c27a805c
SHA1 d2ab0c947f05a6ddf442c81356fe24be96fc7b1a
SHA512 c4d096ef04c25d164285276d27dfa6d4e5942c88bb5adaf415564ffcdd18ad647af4367c455a27a0ad89cc3feafb7f39094a5278dff3c7f24f08cd166d0731bd
SSDEEP 6144:wFZeYfcg8xMWy5hI8OsGMCySrJIT1kdRehyIHq27D:Gpfc52Wy7IlrJnMo3ED
TLSH
T14B746D12B79655F9E957C0788246C673AA3378C60B21B9FF119442393F2BAE16F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

f2:07:ad:0d:f2:f5:ae:d8:e1:28:0d:19:23:3c:a6:d7:69:92:09:81:15:21:c6:5e:0c:cd:4c:58:b3:1d:15:b7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Chains

Oct 27, 2026

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Serial Number

33:00:09:3c:d8:0f:41:68:2c:d1:1e:4f:a1:00:00:00:09:3c:d8

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2026 - Oct 28, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5f:2a:e4:f8:23:45:bc:1a:49:00:00:00:00:00:5f

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

157916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

uvx.pdb

kernel32

RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetModuleHandleW FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject GetCurrentDirectoryW MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree GetEnvironmentVariableW SetLastError SleepEx ReadFileEx WriteFileEx GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle ExitProcess CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread AssignProcessToJobObject CreateJobObjectW QueryInformationJobObject SetInformationJobObject SetConsoleCtrlHandler GetExitCodeProcess GetCurrentThreadId GetLastError LoadLibraryExA GetCurrentThread RtlCaptureContext GetProcessHeap HeapFree HeapAlloc SetThreadStackGuarantee AddVectoredExceptionHandler CloseHandle GetCommandLineW SetFilePointerEx IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader TerminateProcess WriteFile GetCommandLineA FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW FlsGetValue InitializeCriticalSectionEx CompareStringW LCMapStringW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetWindowsDirectoryW GetSystemDirectoryW HeapReAlloc QueryPerformanceCounter VirtualProtect GetSystemTimeAsFileTime HeapSize

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtOpenFile

oleaut32

SysFreeString SysStringLen

Name

.text

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dep-v0

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_6f9b20515905c79dbbb2df72c27a805c_cobalt-strike_icedid

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

oleaut32

generic