Extracted

• • Target
    2026-06-27_07db0dff7b2ecf967f1fa70ba0559a3c_cobalt-strike_icedid_ryuk_satacom_vidar
  • Size 576KB
  • SHA256 8e63429081421a01c09f9651c15b7eeab41a5df44bf6f14d5b8c5198d7237a88
  • MD5 07db0dff7b2ecf967f1fa70ba0559a3c
  • SHA1 b1737e0dc3e0ae1152ea3d312d73b550bb8b9bdc
  • SHA512 6383971f68a28710cc487ab10ffd48e45d32c0f36e39c3f00c124f49c9009d0c0fc1d89d0a4f8807c36aa1e2e37f8d18c11aa54db1e011a986a36db34a4456d9
  • SSDEEP 6144:XD3DmWAOYk3KBIersFBqxXDkwe0RivtVc:uZOYGFB6kN0O
  • TLSH
    T108C46A5377A022F8D062C979C4629A01DB76B4394FA0ABAF073446552F627F09D3EB7C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  besso back ya sdiscoveryasyncratratspywarestealersuricata

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects file containing reversed ASEP Autorun registry keys

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2