Extracted

Extracted

Extracted

• • Target
    2026-07-22_e15381964ab8a89effec8c6aa724b138_cobalt-strike_icedid_satacom_vidar
  • Size 14.4MB
  • SHA256 87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b
  • MD5 e15381964ab8a89effec8c6aa724b138
  • SHA1 4ce1468b5a2aea310d0f9cb89a3b69903f554aeb
  • SHA512 4ab393fb5a4c9af4228d58930172b0c328f7b69bae256972084c8d84e91d3a9d90c6555514a9df64fd9ddbc4bd0047143b4529b223275a7ebc384b3f8525c10f
  • SSDEEP 393216:5N1wS5eHly8k3QDCvhwJIb8qvcwMeg/p/V:XaSSvk37R8Pigh/
  • TLSH
    T1C3E6337391E178E4E091923FE8D68B075F27BE31B238EF4D627291714E692823E75670
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  rundiscoverydownloaderexecutionremus_stealerstealcsvcstealerinstallerpersistencestealerpyinstallerspyware

  • Detects Stealc stealer Version 2

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Custom signature

    Detects Reflective DLL injection artifacts

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2