Extracted

• • Target

    2025-03-29_8a3b83fdea0984b4388d5ebeded4dc02_black-basta_cobalt-strike_rhadamanthys_satacom

  • Size

    10.8MB

  • MD5

    8a3b83fdea0984b4388d5ebeded4dc02

  • SHA1

    bc1884047331647e4633ec0efb7370ea82a316a4

  • SHA256

    c03dc0fa98369cf3ce5429f50ea3df6c9701fe0f10a92182d86c765b66a3fa4c

  • SHA512

    5d261087735a7bd0009ba61755c71469e444142a8aa23e1aa5b96768c0614e1e20e4a9c12d731fddb0c9cbca4d32704caa4d29033ccfecef611b976302aedce0

  • SSDEEP

    196608:VvZnQHQZg0HiouWJysVYvsOaoyMxxvjDDAx0al2dxwMFnVpdVpqmG:HngCHi9WJdoyMxtDDAxBI7VhsH

  Score

  10^/10

  svcstealerdownloaderstealerdiscoverypersistencepyinstallerspyware

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2