Extracted

• • Target
    2026-08-01_fd20b44ba73492da778015b7fca2fc2d_cobalt-strike_icedid_satacom_vidar
  • Size 43.2MB
  • SHA256 ff468dfc811053962e5d44f5c4e62d511aaeb059c7503f1d3e2db05686d7f90d
  • MD5 fd20b44ba73492da778015b7fca2fc2d
  • SHA1 c506e92e18e66be0c2cc9cacbc9c65cdaa9b4284
  • SHA512 20bb07fa726d8771535701c282f90d2226a27f4cb3521367d69f97306f4c43c08ae1f47cae3ca26438bac052e6094ce0f2e209c95f48e176a51e169bc2c1f121
  • SSDEEP 786432:vy3u7jC3MhLsqCJDgKigH5NcYnNTTJDgKiTyCn3bvI7v2immYhIoL/2C03K:6+HhAqeiGFn7iBbQ7v2ibYhIoLf03K
  • TLSH
    T18FA733C88D2EF8FFEDE0813DD6C11EA9CEA578081508DEAE15995A1B5FDC094ACDC80D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionsvcstealerinstallerpersistenceprivilege_escalationpyinstallerspywarestealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2