Extracted

• • Target
    2026-06-02_cf15e4ffc2d00c352348fe1c2a5f156b_icedid_stealc
  • Size 5.2MB
  • SHA256 6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65
  • MD5 cf15e4ffc2d00c352348fe1c2a5f156b
  • SHA1 310cc6053e52025c6adac9918df824999813e23a
  • SHA512 235aeccb57fb63fc7096540cdf8d4c8cdca796cc50795aff3707b96a5448e3bb73f5935fe2833a84b6d20198d2a20b6d695ffc43ea4c8e4cd074beba61a589d7
  • SSDEEP 24576:iQ6etvRsqbQGTw/T2pii7JiqqdpSRRef6APcgMNIije00jrfsVWXe/Srs316wN+D:ix
  • TLSH
    T198461692E32E9C4794193F730C600C095E285FAB7475CF985B5AFAB4E8C92CD19BCE64
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  vps-86defense_evasiondownloaderexecutioncustomerloaderquasarloaderspywaretrojan

  • Family: Customer Loader

    Customer Loader is a downloader written in C#.

    downloaderloadercustomerloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • UAC bypass

    defense_evasiontrojan
  • Custom signature

    Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Custom signature

    Detects executables manipulated with Fody

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2