Extracted

• • Target
    2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar
  • Size 153KB
  • SHA256 43c972c6583a4f18778945dd15d948de7de4c4fe2ce5b5989fc2ec572a7b52da
  • MD5 9f231b51ec30b41502988cc8205c112d
  • SHA1 2d5d0942d1238115f3982d2789fa340ad4a6c450
  • SHA512 2ba7a0d189bed5ac675e8aaee45823c98c1efdf7085ead62a33a86b46c4a04201f9825c514c6f08d786b5f4f2b7c66b2919df5d52f9d8c95146e10f0aac300d8
  • SSDEEP 3072:jGXJ7Zmel5h7udEE0FNhm1PNxG5oY49bYq:jo9mejcdpOA1d9M
  • TLSH
    T106E34A0B73B930F9E1778138C4A15A11F772B8761760ABAF07A046761F236D09D7BBA1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  052026executionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing common artifacts observed in infostealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2