Extracted

Extracted

Extracted

• • Target
    2026-04-24_161536e46756c2376647d4c6a75409ca_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rhadamanthys_satacom_silence_smoke-loader_stealc_vidar
  • Size 5.8MB
  • SHA256 a6820c75cfe27cc30cec7ac379d8955aaf043881e5230c889b7f2394874c6dd6
  • MD5 161536e46756c2376647d4c6a75409ca
  • SHA1 1430504c6ce4513d359f5d02adf9dddc4423fbea
  • SHA512 7c6e0b6b521fd3e172da921eef85db055c40b612bb187d452c8e23f2acde2e852fbe860f76a4e55a960c3a4b1eda982b8f7e8dd4c064fffe36652171ced3775a
  • SSDEEP 98304:SW6Ydej2TQguT4l41PRno+Cev2E9ucwLxrgyPkSHcprUN:jRTQh1PRolfsucWxpPkccprU
  • TLSH
    T12F56E00AA69841F9E0B7827CC56346A2DB727C555731D78F03A03EAA7F633D09E3A711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  282234rundefense_evasiondiscoveryamadeystealcpersistenceprivilege_escalationspywarestealertrojan

  • Detects Stealc stealer Version 2

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Detects Reflective DLL injection artifacts

  • Detects Windows executables referencing non-Windows User-Agents

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2