2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid
Size 861KB
Sample261031-gactqsgd65
SHA256 99d5a72a166bd9bfb339abbdccbe9492ecb7f196de6219222acd27f2afe2fb49
MD5 3b25c759e230bf94819a8ac9b0f9bc9b
SHA1 3d913e772f6e5be77e5cf21dcae0b459937236dd
SHA512 5fba0e5da35668ee240ca2a6f5c16b8f99799362a42f7f10548272418b234783d7ac2d6270139f885d718b53a3e49d1934ae6eb694aab946d7df281c08ef4d10
SSDEEP 12288:gOPUBCxpkz3FPUqpPNLHSw9p7xbG0/YBhSTnvWoExi/r8DMor:gOs0xpkzVTLHj9GoTnvfExi/s7
TLSH
T10415BE46334906F9D28380B5A64B57639B3674990772B9EF01BC51BC3F66AFA0F39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid

File Explorer

2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid

.exe 861KB

2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid

IMPHASH 8f8a3d020c3af63025f314d38f8da605
SHA256 99d5a72a166bd9bfb339abbdccbe9492ecb7f196de6219222acd27f2afe2fb49
MD5 3b25c759e230bf94819a8ac9b0f9bc9b
SHA1 3d913e772f6e5be77e5cf21dcae0b459937236dd
SHA512 5fba0e5da35668ee240ca2a6f5c16b8f99799362a42f7f10548272418b234783d7ac2d6270139f885d718b53a3e49d1934ae6eb694aab946d7df281c08ef4d10
SSDEEP 12288:gOPUBCxpkz3FPUqpPNLHSw9p7xbG0/YBhSTnvWoExi/r8DMor:gOs0xpkzVTLHj9GoTnvfExi/s7
TLSH
T10415BE46334906F9D28380B5A64B57639B3674990772B9EF01BC51BC3F66AFA0F39B10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c5:90:7d:07:1c:8f:de:5d:cb:ea:40:c6:29:9a:32:5d:08:90:55:6e:91:01:88:7e:bf:bb:4c:7c:5b:8a:ec:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WinSvc Systems

Chains

Oct 29, 2026

CN=WinSvc Systems

Subject

CN=WinSvc Systems

Serial Number

35:ab:70:52:05:45:38:be:42:e1:5c:af:29:5f:34:bf

Issuer

CN=WinSvc Systems

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 23, 2026 - Oct 23, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

214932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Loader.pdb

ntdll

RtlUnwindEx NtReadFile NtOpenFile NtCreateNamedPipeFile NtWriteFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtUnmapViewOfSection RtlNtStatusToDosError RtlPcToFileHeader

kernel32

HeapSize LCMapStringW CompareStringW GetProcessHeap HeapFree FindClose CloseHandle FindFirstFileExW GetLastError FindNextFileW SetFileAttributesW CreateMutexW GetCurrentProcess GetTickCount64 GetCurrentProcessId GetACP GetOEMCP GetVersion GetConsoleCP WaitForMultipleObjects GetOverlappedResult WaitForSingleObject GetExitCodeProcess GetSystemTimePreciseAsFileTime CreateProcessW GetThreadContext ReadProcessMemory VirtualAllocEx WriteProcessMemory VirtualProtectEx SetThreadContext ResumeThread CreateThread SetHandleInformation TerminateProcess SystemTimeToFileTime CreateFileW SetFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetCurrentThreadId FlushFileBuffers GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte GetModuleHandleW FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree IsThreadAFiber FlsSetValue HeapAlloc GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleA GetFullPathNameW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo ReadFile CompareStringOrdinal GetEnvironmentStringsW VirtualProtect GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateWaitableTimerExW SetWaitableTimer Sleep InitializeCriticalSectionEx SetLastError FreeEnvironmentStringsW FlsGetValue GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo IsValidCodePage GetCommandLineW GetCommandLineA ExitProcess WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent EncodePointer RaiseException EnterCriticalSection SetFilePointerEx

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteW

user32

GetSystemMetrics GetDoubleClickTime GetCaretBlinkTime GetKeyboardType GetDesktopWindow GetKeyState

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

WSASocketW WSAStartup freeaddrinfo getaddrinfo getsockopt ioctlsocket WSAGetLastError connect select closesocket

Name

.text

Size

267KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid

PE Signature issue

ntdll

kernel32

advapi32

shell32

user32

api-ms-win-core-synch-l1-2-0

ws2_32

generic