Extracted

• • Target

    2025-03-31_0c346b920e9e8cb2aec79f266136a2c6_black-basta_cobalt-strike_rhadamanthys_satacom

  • Size

    8.2MB

  • MD5

    0c346b920e9e8cb2aec79f266136a2c6

  • SHA1

    d6d1647b92a99cb2ba4825ff9de3bc9565d2ad2a

  • SHA256

    5d810742b237cff382603e72f539db2e9da10200392cdae2814c69570b87e10d

  • SHA512

    58db68f5fd6662cd680d2c78110cc360500366b1f34416d5673e766337b3306356ecd0bd9e519632b09ad5f4269d6c859aa39c19bf2be87f6e568a6705c0c51a

  • SSDEEP

    196608:AbGj0roFYs/IU8M9onJ5hrZER7QEzv5NFohQ9pavG3S:pjWwI3M9c5hlER8ENPoQ9peG3S

  Score

  10^/10

  svcstealerdiscoverydownloaderpersistencepyinstallerstealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2