Extracted

• • Target
    2026-05-16_bf08196500932928a160405ad8aabbb9_cobalt-strike_icedid_satacom_vidar
  • Size 1.7MB
  • SHA256 f697f0ee064dbfafaa52ca99f554d12937d86c75df1047c14a3dc0397831d685
  • MD5 bf08196500932928a160405ad8aabbb9
  • SHA1 d0c8d211ae7f7285d8d1b5ec1e06982989fbada3
  • SHA512 f15ff475393686f5924a88edbaf237d68931c83a3c4e163dae5533f23ef1924da29e52c2100d45e80e374b03123af015c2dcc3dfa9a3c46ed5fe879d25505511
  • SSDEEP 24576:w2KmmwKu4d/BLPbaTdHAr+WcbTeHa6VRiYUSalaJwmu7z0rvj4htawU9htdHXcNF:lKmQuU/pPuTd8G6VjJk3E8htaTRuoQHp
  • TLSH
    T1A285231B62B571F9E03787344820598AD771B4B35631AF0F07A26A535E3A9E16C3EF32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryphemedronepersistencespywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables using Telegram Chat Bot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2