unix_stealer | 9ae6350c3ac681bf9191b369148f1dcc5ccdc12d2b7dbdd86a675e2f757c1e6f

General

Target
2026-05-03_d48c1acc7169d11a9385c6b0918a16fc_cobalt-strike_icedid_satacom
Size 2.4MB
Sample260503-d6agpsbs2y
SHA256 9ae6350c3ac681bf9191b369148f1dcc5ccdc12d2b7dbdd86a675e2f757c1e6f
MD5 d48c1acc7169d11a9385c6b0918a16fc
SHA1 00b18e910fc63d4bf16af3cc4e4dd130bb5af545
SHA512 0d8f59a2731be14daa5aea663df7f2d1a58dcdf32a6b7e6c02c4016f004274b186d9dc649251b2aa0be389826bdfda08b21605eab1d44a5f446a3ee98f3a0b93
SSDEEP 24576:Gf7+Z2AvGTJVvVw5pUFb6wwQUdsyRbpUFT2ZeWfw0MVARYT2+WMnpjMVHlr9559E:QbAD37ofTVwsj7
TLSH
T1E7C512D73E9C47F2E96B383984840A8BA7A1DF0BC680F58B55E1059F5D1B8A3097CF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-03_d48c1acc7169d11a9385c6b0918a16fc_cobalt-strike_icedid_satacom
- Size 2.4MB
- SHA256 9ae6350c3ac681bf9191b369148f1dcc5ccdc12d2b7dbdd86a675e2f757c1e6f
- MD5 d48c1acc7169d11a9385c6b0918a16fc
- SHA1 00b18e910fc63d4bf16af3cc4e4dd130bb5af545
- SHA512 0d8f59a2731be14daa5aea663df7f2d1a58dcdf32a6b7e6c02c4016f004274b186d9dc649251b2aa0be389826bdfda08b21605eab1d44a5f446a3ee98f3a0b93
- SSDEEP 24576:Gf7+Z2AvGTJVvVw5pUFb6wwQUdsyRbpUFT2ZeWfw0MVARYT2+WMnpjMVHlr9559E:QbAD37ofTVwsj7
- TLSH
  T1E7C512D73E9C47F2E96B383984840A8BA7A1DF0BC680F58B55E1059F5D1B8A3097CF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery unix_stealer spyware stealer
- Detects UnixStealer payload
- Family: UnixStealer
  UnixStealer is a Windows stealer written in C#.
  stealer unix_stealer
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables Discord URL observed in first stage droppers
- Custom signature
  
  Detects executables containing commands for clearing Windows Event Logs
- Custom signature
  
  Detects executables referencing Discord tokens regular expressions
- Custom signature
  
  Detects executables referencing credit card regular expressions
- Custom signature
  
  Detects executables referencing many VPN software clients. Observed in infosteslers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  Detects executables referencing virtualization MAC addresses
- Custom signature
  
  Detects executables using Telegram Chat Bot
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2