Extracted

Extracted

• • Target
    2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar
  • Size 20.1MB
  • SHA256 64476622e882ab6953411889eac2eb280cd257cbb539285bc6c1a1d332f6b566
  • MD5 ee859206f59319637aa601fa41098b7a
  • SHA1 91a4c4a072bd93cb1d17553ed9e4d33f1831f812
  • SHA512 c7bbacb9dcf60eae566352399986861dc66ccff71c187b93f99e285c35331e41e3a65dee6b84ecfd10caf1fc5660b6c400c86581aea972c789ff814485a0520c
  • SSDEEP 393216:H4SvbbaX90TEZ4+xCuBkho4YbeGsFrSClVLLmXf9WVFid0B49iRqcQEUnZ5:H4AvI90TEZNCuGunaSClVLLmP8VFiEGX
  • TLSH
    T13227338B653871D8C166937B9EF8A32CFD7A60795B84380E0A6C85B4BF973344C65393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionblankgrabberremus_stealerstealcpersistencepyinstallerspywarestealerrun

  • A stealer written in Python and packaged with Pyinstaller

  • Detects Stealc stealer Version 2

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • Detects Reflective DLL injection artifacts

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Downloads MZ/PE file

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2