Extracted

• • Target
    2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc
  • Size 5.2MB
  • SHA256 95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1
  • MD5 f66b3148779feaac0b639c57b05e4f6d
  • SHA1 c92401995243abd0b48b8f377c232f602024ce3f
  • SHA512 0212bd9f09ddc0fd75687e97c6ac97f3f21f2e6a9b97f541f41ee08329e9dbe95c1363753800f42bb4d04249034474905ede8367bd4a61d3d9c9b7fb9a330648
  • SSDEEP 98304:PFReC9qccakO2BU3ZFrroMLG8PRYTq+5j+hyj9ZCKYo1toInWLvY+2weePZ4+sAU:PFl9Qb23zI+BYLDzHrtoInqY+5WADf6n
  • TLSH
    T18C464A8907AE7435E262BF7C1CB0C6036C2396944F2885E7F9931835FD4B958E3E969C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  vps-86defense_evasiondownloaderexecutioncustomerloaderquasarloaderspywaretrojan

  • Family: Customer Loader

    Customer Loader is a downloader written in C#.

    downloaderloadercustomerloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • UAC bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables manipulated with Fody

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2