2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid

General

Target
2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid
Size 383KB
Sample261102-gr4nsafs3x
SHA256 ea5075cf54bbcf7da9496161996cd7dafdf7cb0d5abecc48540246f717895b8d
MD5 e01dcb8f26ca34dc3fd059e052931968
SHA1 15175456632d56d68c13f427e4e251c0f3e7d5ce
SHA512 fe052a10c70a34bf0bdbf166c36fdbe50d337fe73f3e351736ed56622092a4b7ad6e29ab13168bfe331a7a546febffc8715e32df574907240e587c2ceddec42f
SSDEEP 6144:rdL6RkzYBf70/hpLIG1C6cUmQvZB4v8INYch9HRg6gYZEQV5vrhU09NxChMBQ6:B6HTgpHsQmDNXrH1ZNd7K
TLSH
T15C844A15FA5618ECE056C13482568972A97278CE0B31ADFF22D842383F7ABF55E3CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid

File Explorer

2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid

.exe 383KB

2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid

IMPHASH 11eb8d19bd4efa1ef774dfc85542530d
SHA256 ea5075cf54bbcf7da9496161996cd7dafdf7cb0d5abecc48540246f717895b8d
MD5 e01dcb8f26ca34dc3fd059e052931968
SHA1 15175456632d56d68c13f427e4e251c0f3e7d5ce
SHA512 fe052a10c70a34bf0bdbf166c36fdbe50d337fe73f3e351736ed56622092a4b7ad6e29ab13168bfe331a7a546febffc8715e32df574907240e587c2ceddec42f
SSDEEP 6144:rdL6RkzYBf70/hpLIG1C6cUmQvZB4v8INYch9HRg6gYZEQV5vrhU09NxChMBQ6:B6HTgpHsQmDNXrH1ZNd7K
TLSH
T15C844A15FA5618ECE056C13482568972A97278CE0B31ADFF22D842383F7ABF55E3CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

212688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

heysafe_osrescue.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

WriteConsoleW AttachConsole SetConsoleTitleW AllocConsole GetProcessHeap GetStdHandle GetLastError HeapSize FormatMessageW HeapFree LCMapStringW CompareStringW CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject VirtualProtect SetLastError GetFullPathNameW InitializeCriticalSectionEx FlsGetValue GetCurrentThreadId SetFileInformationByHandle CreateFileW GetCurrentProcess DuplicateHandle HeapReAlloc QueryPerformanceCounter GetStringTypeW SetStdHandle GetCPInfo CreateThread GetOEMCP CreateEventW GetACP IsValidCodePage GetCommandLineA WriteFile LoadLibraryExW FreeLibrary GetCurrentProcessId TlsFree ReadFileEx SleepEx WriteFileEx ReadFile GetOverlappedResult FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind TlsSetValue GetSystemTimePreciseAsFileTime TlsGetValue CancelIo CloseHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetEnvironmentStringsW TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetExitCodeProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW LeaveCriticalSection lstrlenW EnterCriticalSection FindFirstFileExW FindClose ExitProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex EncodePointer DeleteFileW GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW GetModuleHandleW FlsSetValue IsThreadAFiber GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW QueryPerformanceFrequency RaiseException FindNextFileW RtlPcToFileHeader RtlUnwindEx SetFileTime IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtWriteFile NtOpenFile

Name

.text

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic