stealc | d89a0439b61dc4f482d59a1b0db2e7f5b66f4f4d0abd1bbc459e0ca6ab9e2796

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe
Size 937KB
Sample260415-tmkrbsfw5x
SHA256 d89a0439b61dc4f482d59a1b0db2e7f5b66f4f4d0abd1bbc459e0ca6ab9e2796
MD5 5c1eca049dbe66688f345990ed075e17
SHA1 43cea2b43742a8c65d0f4b8ab36276069c02a3c7
SHA512 4c6d7d17ca42d202f27862f13f8c42702db6082f797555ddf42936ee74d2969e1740c6ace9144e64e5d8ef2e10fd06427711d4e2847f1fd63ce53da4a1721f82
SSDEEP 24576:dO2Ow+cHqWiGYC8f8vgiuejzCFtDGst4:ddP+r4y
TLSH
T1B81502A287C40FFEDEEA093444F42659D3B07E658A25A9CB4FF2BF472E535C04639A41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zorizxcq stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

zorizxcq

http://95.85.238.4

Attributes

url_path
/e99c8470d3ebe7696e4a.php

rc4.traffic_key

rc4.C2

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000002166e-2.dat	family_stealc_v2

Executes dropped EXE 1 IoCs

pid	Process
1660	7fcb7df545f2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 1660	5764	2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Local\Temp\7fcb7df545f2.exe
  "C:\Users\Admin\AppData\Local\Temp\7fcb7df545f2.exe"
  2⤵
  - Executes dropped EXE
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

7fcb7df545f2.exe

Path C:\Users\Admin\AppData\Local\Temp\7fcb7df545f2.exe
Size 761KB
SHA256 21ee024832d3d678b235326fd3add8d34e4cfc1651a03378e8237daa3631a514
MD5 b28c3a6376e917c793e46fa5a8969e4e
SHA1 8e2c99ae9a7165da6604ce331de8578c70e2819d
SHA512 2047cee9d1bd9c7c894693a3fe2455e9f0f5ab96a04cdfa58dd42596219645e400b59badff31aa7e060efc686134242566969dec3e62f9fbf28fc212e07abc38
SSDEEP 12288:JzvOznjd7Dkqya3OJXJyZzNP8GTop8mWN88yxBlDetAqxSva:8XOqyzJXIPkEWRwvybS
TLSH
T1BBF48C1BE7A602F9D1B7C274CA424957E772B8065370978F03E14AA61F376909F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download