Extracted

• • Target
    2026-08-05_dec9a7fd73ccaf986fee8b9aab2905f4_cobalt-strike_icedid_satacom_vidar
  • Size 44.1MB
  • SHA256 e1983047ca428c8047060030e532b358f55a22d93d5094dc1146a841c57b79bb
  • MD5 dec9a7fd73ccaf986fee8b9aab2905f4
  • SHA1 5ac4e18026aa0b737ab193dde24ff62298eed2cf
  • SHA512 784f0ece40ed2ee0b1d064333c404073272425a5280f61472b22bab02b8b3b186d899198d7ef74ffa1e24e2aac9696034e319f6d4721f52d4c28683698108963
  • SSDEEP 786432:o962M4d+962I4dBtPkGBUNS86MFtOWHQwUmu5Pig+QE1MFtOWHQwUm8JRz5ctJFz:f2M4dJ2I4dB6GCaMFtTQ3Qn1MFtTQ3R
  • TLSH
    T1EDA7330A711F658BEF3837BE3FAD5B5EC204DCC0C6529BD006C552662B4BDD1AD68A83
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionsvcstealerinstallerpersistenceprivilege_escalationspywarestealertrojan

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2