Extracted

• • Target
    2026-07-10_4fe4bd4d43c80982439ca2fe61bbda28_cobalt-strike_icedid_stealc_vidar
  • Size 2.6MB
  • SHA256 269275be010ded7d7b5ba89617db7fac23162d70e47228ea4fcff0586dab3caf
  • MD5 4fe4bd4d43c80982439ca2fe61bbda28
  • SHA1 08d121e5f565d38e8736f46dd18ada7f0875719a
  • SHA512 1fe785915936974abb7497009a4f5e3546abd9b79818642ada368d02fbdb801c0ea43dd23d5a049e735c47399f87a0336f2b84a091defe410d6c229b1f3f0ba7
  • SSDEEP 49152:goLf41/ftlZ1OPPMDDEHcUVTV6qmQ2qfGH+DkDGwpJsJUth09vB5iEfAvSa:aBF1sPMYVGTq+H/zHz095gE
  • TLSH
    T1F0C533A332E1B4F9F2B78379C9410617F362BC7403345B5B06A046596F6B6D05E2EBB2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutioncyber_stealerdonutloaderloaderpersistencespywarestealer

  • Detects CyberStealer

  • Detects DonutLoader

    loader

  • Family: CyberStealer

    CyberStealer is an infostealer written in C#.

    stealercyber_stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Modifies WinLogon for persistence

    persistence
  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables referencing many Password Manager software clients. Observed in infostealers

  • Custom signature

    Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2