Extracted

• • Target
    2026-05-16_44ed4994ca5fa79b82bc6596d17a7721_cobalt-strike_icedid_satacom_vidar
  • Size 1.7MB
  • SHA256 bdead57a5b3a15e40be889ad66627b35d65865668802b1232ec5e441c967c35f
  • MD5 44ed4994ca5fa79b82bc6596d17a7721
  • SHA1 b8d39a0faa6b5d6f2c27a3177c9ea70e9aa33177
  • SHA512 a207b229f799d291ee45f5f83c5b283df8d372ed039efac4020baf54959a60e42527a4b1f7e3dbe319247b034bf057881def6c703a77715865c700bc24477d5d
  • SSDEEP 49152:lKhajxiZpe+BeScOvrhWF7Kzx9RizlMaOMPoDOex:0AuI+uWrho7qEWiu5x
  • TLSH
    T1E885230BE7E634F9E977823D92812946D7A139304235DF7F9BA489522E332D08D2BF15
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  phemedronepersistencespywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables using Telegram Chat Bot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2