2026-11-01_e08ace616c9720cfb53f41e2c7d2161c_cobalt-strike_icedid_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_e08ace616c9720cfb53f41e2c7d2161c_cobalt-strike_icedid_stealc
Size 695KB
Sample261102-gpvm4a1scy
SHA256 c6bec29776e36df9a8fff435e596c21008e8bbe9f61a8d3b7d5aede209cd3414
MD5 e08ace616c9720cfb53f41e2c7d2161c
SHA1 f25fb9d6e21432be3a4c22b9331c093e665e4f9a
SHA512 318758f8c7966fecf7988b2bbab1a305e8b4fe1b78ae07cf25278f53a372a050820451cd3a0834dc60c503fa66a04fe4519ab2bae0eab66925e1e24d1d046c11
SSDEEP 12288:yeSIt6lLl2eph0lhSMXl+P6lU82nwzOJk+MhoZXhNOnhuyje:nS552Uh0lhSMXlI6u82Eukbhoh7ODe
TLSH
T189E4D016FBD590F8E15BC27488760E15EB73788947C196DF87A84EB12E23AD05E3DB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_e08ace616c9720cfb53f41e2c7d2161c_cobalt-strike_icedid_stealc

File Explorer

2026-11-01_e08ace616c9720cfb53f41e2c7d2161c_cobalt-strike_icedid_stealc

.exe 695KB

2026-11-01_e08ace616c9720cfb53f41e2c7d2161c_cobalt-strike_icedid_stealc

IMPHASH 4fe4cbe3f1eef29244a0a0b01016c849
SHA256 c6bec29776e36df9a8fff435e596c21008e8bbe9f61a8d3b7d5aede209cd3414
MD5 e08ace616c9720cfb53f41e2c7d2161c
SHA1 f25fb9d6e21432be3a4c22b9331c093e665e4f9a
SHA512 318758f8c7966fecf7988b2bbab1a305e8b4fe1b78ae07cf25278f53a372a050820451cd3a0834dc60c503fa66a04fe4519ab2bae0eab66925e1e24d1d046c11
SSDEEP 12288:yeSIt6lLl2eph0lhSMXl+P6lU82nwzOJk+MhoZXhNOnhuyje:nS552Uh0lhSMXlI6u82Eukbhoh7ODe
TLSH
T189E4D016FBD590F8E15BC27488760E15EB73788947C196DF87A84EB12E23AD05E3DB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

414368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\code\private\closurefun\jewfuscator\build\files\release\sample.pdb

Name

.text

Size

155KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

203KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.7m12tk

Size

319KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

2026-11-01_e08ace616c9720cfb53f41e2c7d2161c_cobalt-strike_icedid_stealc

kernel32

generic