49444dee73a99a7505106f89cd04f1f9bb53df3d095e71d2e2b8dfb312f6720d

General

Target
2026-07-02_c6cff98c6b3112f5d20d78afd53db30f_cobalt-strike_icedid_satacom_vidar
Size 14.0MB
Sample260702-m2967sgv7t
SHA256 49444dee73a99a7505106f89cd04f1f9bb53df3d095e71d2e2b8dfb312f6720d
MD5 c6cff98c6b3112f5d20d78afd53db30f
SHA1 c51a833ae2b8a4c93bd140e49063a6a50bf34cf5
SHA512 a8d50cf3073b8be0428f9a5969b6b01cf45b7bd0f08fb518798940de153c8b66d4cc0caa522aeb26fabcd80075d8c969386a7fd73fb2b511ea61d8c8f24af6b1
SSDEEP 393216:FZ+FTrzsQVZiXaHVeKdtf6uckrB2CzdSQ:FMsTX0Dt/PHoQ
TLSH
T12EE6332562973CDCF5714230A1A202068AE5FF65B3438FADCAF45B5A0E9F392CD72916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-02_c6cff98c6b3112f5d20d78afd53db30f_cobalt-strike_icedid_satacom_vidar
- Size 14.0MB
- SHA256 49444dee73a99a7505106f89cd04f1f9bb53df3d095e71d2e2b8dfb312f6720d
- MD5 c6cff98c6b3112f5d20d78afd53db30f
- SHA1 c51a833ae2b8a4c93bd140e49063a6a50bf34cf5
- SHA512 a8d50cf3073b8be0428f9a5969b6b01cf45b7bd0f08fb518798940de153c8b66d4cc0caa522aeb26fabcd80075d8c969386a7fd73fb2b511ea61d8c8f24af6b1
- SSDEEP 393216:FZ+FTrzsQVZiXaHVeKdtf6uckrB2CzdSQ:FMsTX0Dt/PHoQ
- TLSH
  T12EE6332562973CDCF5714230A1A202068AE5FF65B3438FADCAF45B5A0E9F392CD72916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery persistence pyinstaller spyware stealer
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2