Extracted

• • Target
    2026-05-16_4e7dc78e02e17b2c7363ef03e5d2031c_cobalt-strike_icedid_satacom_vidar
  • Size 1.7MB
  • SHA256 774e32d19ecaf9bd75ecb1e32f23c0750fd1708d91a3a13f8053637012021aa1
  • MD5 4e7dc78e02e17b2c7363ef03e5d2031c
  • SHA1 c8bb9db38543c2c7022b72a72d62b07c6b029a1d
  • SHA512 6098bd0eefae1883761fb024557214c04913b5e5a04e2b96db10a27d47f97b28f7dddee162c9477dc13e5a718bec2c225fd7744fcf30142f0e6865603b842e27
  • SSDEEP 24576:u2KTTmrMmD4Zarx9GNAuPkA2ieCvHqgrpkFxz45/8vVK9LKNVKomXezOcVlaAtpg:zKXmrMy4ZEgAF2pqnvCROzOcVlaAbOiA
  • TLSH
    T18C85230BB22830ECE479C2B440A245A9F776B9751625EB7FC77446081F675A68C3EF0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  phemedronepersistencespywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2