Extracted

• • Target
    2026-08-03_f215f0b115ee460fdbfd68b0fe8f84ce_cobalt-strike_icedid_satacom_vidar
  • Size 40.3MB
  • SHA256 9f22a150c460cafa17267d01df9a09583853ae192a9c93e92c87ad14a90a74ca
  • MD5 f215f0b115ee460fdbfd68b0fe8f84ce
  • SHA1 3da86b9e80dd4e0fe40a3cefc4ee92d04283fa57
  • SHA512 a3e093f0017e99683a0c0fae1aed8538f326505c5e9e9cf2d8522968748aa8f7dfbf564c789e7f80d5e82b00c5765b20a838d6ac8099c6d3b1b23d4181b8dddb
  • SSDEEP 786432:Mf+4gf+4eGR3Z4+duskfxhv1ZPftlnskfxhv1ZPUv4fhKdllHAAS0L7:4tUte6mUCl38lgASa
  • TLSH
    T1A19733ADB5DB01A3CE3A15FF31125ABD87E5ADB71D023C960420808E6FE86D8DE5572C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionsvcstealerinstallerpersistenceprivilege_escalationpyinstallerspywarestealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2