Extracted

• • Target
    2026-03-31_8db230dc347bd3a351123c951e9dfbb7_cobalt-strike_icedid_satacom_stealc_vidar
  • Size 281KB
  • SHA256 ae39a7ce948350eae641229c5055b7bd80746c2f7b8be546e963d691c8981b13
  • MD5 8db230dc347bd3a351123c951e9dfbb7
  • SHA1 368eb5d75070f526eff4cffbd7d5fea0e8482c4e
  • SHA512 b1a43999879776e52ce0a0d13a4fbff7ced7060ad539b7a6aba63f365499879f84c28c6fa0a1adda1aeb38f5067e58e134262201fec1f5dad9bbde661f98d3ea
  • SSDEEP 6144:oL0/8IAiofFh13oMnIWB28mnEBlUq3nuAjv6krCYviAB8ld:owYFh13oMnIWBNLBlUqdjvPrCYs
  • TLSH
    T1EC546B1A73A40CF8E9B7923DC9564942E772BC160760EBDF03A086572F276D19E3EB11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ssssssssss21stealcstealerdiscoveryspyware

  • Detects Stealc stealer Version 2

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2