2026-10-28_51b9e135a87226dacbc5133cd4fb331a_cobalt-strike_icedid_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_51b9e135a87226dacbc5133cd4fb331a_cobalt-strike_icedid_stealc
Size 289KB
Sample261030-e927kav1bw
SHA256 756cc9d51ca379ebd7bb88c395db3df68d2b3039729514eb470c9e47bcedb8bc
MD5 51b9e135a87226dacbc5133cd4fb331a
SHA1 d51a1ca06327012dbb588fa1298a2adc285eb7ea
SHA512 77d82bb71fcb7e85138acd6b8ddd3a05266b119c79eba4ae5d53961cea7f7bc9aa6ce183667d6fc2eb852139f5bf6296c19b0fc649556999f2aadf333938431d
SSDEEP 3072:iVxX14jHuxlwUKvPxT6jXVDFsYdXyh1Kjep2ZM2DdxyLfFDisxmJTQSaMm5/6CSn:iVxmeQ5T6jlfdXyUeQlpAhSWlEB
TLSH
T152547D19F7A820F9E577C17DC9424906DA7278564770EBCF13A04AA62F23BE05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_51b9e135a87226dacbc5133cd4fb331a_cobalt-strike_icedid_stealc

File Explorer

2026-10-28_51b9e135a87226dacbc5133cd4fb331a_cobalt-strike_icedid_stealc

.exe 289KB

2026-10-28_51b9e135a87226dacbc5133cd4fb331a_cobalt-strike_icedid_stealc

IMPHASH b98adc9a6e4390b6388c29469b117d15
SHA256 756cc9d51ca379ebd7bb88c395db3df68d2b3039729514eb470c9e47bcedb8bc
MD5 51b9e135a87226dacbc5133cd4fb331a
SHA1 d51a1ca06327012dbb588fa1298a2adc285eb7ea
SHA512 77d82bb71fcb7e85138acd6b8ddd3a05266b119c79eba4ae5d53961cea7f7bc9aa6ce183667d6fc2eb852139f5bf6296c19b0fc649556999f2aadf333938431d
SSDEEP 3072:iVxX14jHuxlwUKvPxT6jXVDFsYdXyh1Kjep2ZM2DdxyLfFDisxmJTQSaMm5/6CSn:iVxmeQ5T6jlfdXyUeQlpAhSWlEB
TLSH
T152547D19F7A820F9E577C17DC9424906DA7278564770EBCF13A04AA62F23BE05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptFinishHash BCryptOpenAlgorithmProvider

kernel32

GetProcessHeap ReadFile GetStdHandle WriteFile OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetCurrentProcessId QueryFullProcessImageNameW SetUnhandledExceptionFilter VirtualFree DeviceIoControl VirtualAlloc CreateFileW GetCurrentThreadId GetModuleHandleA GetProcAddress GetModuleFileNameW GetTempPathW SetEnvironmentVariableW SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetFileType IsDebuggerPresent FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent RtlUnwind GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DeleteFileW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc FindClose FindFirstFileExW

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

ntdll

NtQuerySystemInformation NtUnloadDriver NtLoadDriver RtlInitUnicodeString RtlAdjustPrivilege

Name

.text

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.arespol

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.veyraid

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_51b9e135a87226dacbc5133cd4fb331a_cobalt-strike_icedid_stealc

bcrypt

kernel32

advapi32

ntdll

generic