Extracted

• • Target
    2026-05-17_d6817c77d38018b46546650934ac4912_cobalt-strike_icedid_satacom_vidar
  • Size 1.7MB
  • SHA256 da8b503defa8487470436d8ffd1d046316ef04661f3771418d2a70500900fbd5
  • MD5 d6817c77d38018b46546650934ac4912
  • SHA1 659bc83abbda5f9e5288329eb51b5c472d8b45c5
  • SHA512 dd9832f60569aec172d6fc222047d86e98ba251b1c41f409bbc185e613869216ff6bfd0876f4edc2511f01a62304c954245a6bcb9552d6f5edc0443886bf59ee
  • SSDEEP 49152:SKVqoFNAn1RGCOiKlMh31I2k8s2maTvOMpFK0q:1JqRGCOUtk8vjTK0q
  • TLSH
    T1D5852397336039FAEA7AC5B4CC020358D7B5B43166609F0F43A993472E527E64E2DBB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  phemedronepersistencespywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2