Extracted

• • Target
    2026-05-23_ea672a7a6e6e746690430bf465aa9833_cobalt-strike_icedid_satacom_vidar
  • Size 50.0MB
  • SHA256 a78431db8deff3abc0b836327715a546f9d177f35e1874f34007dbd9ac8a8deb
  • MD5 ea672a7a6e6e746690430bf465aa9833
  • SHA1 2bd747f9df3fedb878f0ea429fc8ed2bd2509f6f
  • SHA512 a6a1261af9fc192a500ae0c59f7f07b9017b1ef3530196d7605a43c51a331b571e022c496a35d540325daaa38b8c4bce140b16abbc90d7bcb1a088bc2326ddb1
  • SSDEEP 1572864:fYyL0xxJlwZI90LdEttSrjNlVz7aUZI4SR:Ae0Z90qqVFu4Y
  • TLSH
    T103B733051F6464D2F4A99A7FD598CE312437BD06A83E699A11FFED9F3A331C01F2A412
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  06x05x2026discoverystealcpersistencepyarmorpyinstallerspywarestealer

  • Detects Stealc stealer Version 2

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detects Reflective DLL injection artifacts

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2