Extracted

Extracted

• • Target
    2026-07-15_e4a9ecd93cc57492de6965c472f4a6af_cobalt-strike_icedid_satacom_vidar
  • Size 16.4MB
  • SHA256 62c425f43d0a39c14ad94ae6c117e3aee398a4a3e617b01dc7602e8c39a93840
  • MD5 e4a9ecd93cc57492de6965c472f4a6af
  • SHA1 a159551da1bac5842b436325570e2133c1fcb33f
  • SHA512 2d21829b18437ab880d4213beac753815c9a7e631e5cd4286626012b5a4003aed0e193428f422a6afc5ffd36912f0ae4eeffe6ec670adcfe6b16665928647a89
  • SSDEEP 393216:4dCr4nw6H3IhXFIlbP3H8czsW5MvcelZwGzR5KDP:4da60XFIp3HNqce4CR
  • TLSH
    T15807337A5A5186F7D17334F98B75A612C368FD2F0A0487067CBC39EA1A3054BCD3686E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  10x06x2026282234discoverydownloaderexecutionamadeystealcsvcstealerinstallerpersistencespywarestealertrojan

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2