Extracted

• • Target
    2026-08-07_37ee826b69833df4686c1138d63a47c2_cobalt-strike_icedid_satacom_vidar
  • Size 32.2MB
  • SHA256 2bc75e187c300a527d186001aae17d45d5b18629482ca7cd4a1d8224ef14f512
  • MD5 37ee826b69833df4686c1138d63a47c2
  • SHA1 a5d16328ef4d56acd1767b87176410ab9ba5f763
  • SHA512 22193e8877d8a2bb22aece7fd26e27b5ec0fa8664e8a3aebdbb0a1c32f03932508e8b8838fa5fd587862c37a8ca1fa62d3abf630de8913fd44f219b92735dc66
  • SSDEEP 786432:251Tu5eTPuuxZLdxp6jDcSiHOwofYkui7gzWEAT7X3pSG:25Fu5WPnx3GjDcNumi7guL3pSG
  • TLSH
    T116773339DE78303DF4296E766C89CCAA5F396134C4D4BB3B858B87513CB54964CEB20A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionsvcstealerinstallerpersistencespywarestealerprivilege_escalation

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing bas64 encoded gzip files

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2