Extracted

Extracted

Extracted

• • Target
    2026-07-27_26b1441b6408b20e0118827ac90a12bb_cobalt-strike_icedid_satacom_vidar
  • Size 17.6MB
  • SHA256 2fc8cabf074616e31880562c58c62874e5d9e3925d2c8603460ba26560b5ffa4
  • MD5 26b1441b6408b20e0118827ac90a12bb
  • SHA1 516e9c2578f75bcf8a520ff249a7163c50a7c7e8
  • SHA512 318e44029fb9ce045a2126ea0a3b8865f638e59d6b4f124376640ae62ea923288e60b29240555157fcf8a9d2f07c0d7ac48bebc8565234c61ce9396b9a9e12ec
  • SSDEEP 393216:vphpS3Vya2b/c6zbj3pEqxKkKqtg05FW9oxs:vphpSib/c6z3LcIFwo
  • TLSH
    T12607334D38CA21F8E260E574A8E45D14EF37A82E0F52F6DA3E7842F5AF53EC44E14592
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  rundiscoverydownloaderexecutionstealcsvcstealerinstallerpersistencepyinstallerspywarestealerremus_stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detects Reflective DLL injection artifacts

  • Detects Windows executables referencing non-Windows User-Agents

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2