Extracted

Extracted

Extracted

• • Target

    2025-03-31_bb4bfab94400b5d96f99fe242c63d5cd_black-basta_cobalt-strike_rhadamanthys_satacom

  • Size

    10.8MB

  • MD5

    bb4bfab94400b5d96f99fe242c63d5cd

  • SHA1

    1835f0f12c6cc142611f367d723a45cb7aa805d9

  • SHA256

    b97db6af674f67d377c78906e262c2b3cb8b8c80c9edbb585c3ed8c81387d90e

  • SHA512

    1e9c8470e48b2add8cb44c6b41b5f68ed6bf9e190a34b6bbc00a6eb32eabbb571882113aec85fcc65a168dc28b3ca9c080d6a5d1de6685b6fe7c089a552023d8

  • SSDEEP

    196608:VvZnQHQZg0HiouWJysVYvsOaoyMxxvjDDAx0al2dxwMFnVpdVpqmN:HngCHi9WJdoyMxtDDAxBI7VhsU

  Score

  10^/10

  svcstealerdiscoverydownloaderpersistencepyinstallerspywarestealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1