Extracted

Extracted

• • Target
    2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar
  • Size 6.8MB
  • SHA256 7a077d84bc19099d4a17ea2d3bd75dce5b72a6be46906cb78ba6ca0a8334d946
  • MD5 121531cb07077f91defeea5bbe43f436
  • SHA1 0373723b8887656b5e2bc1a8730a3e37c70765f0
  • SHA512 dcd4c7404b4ba920c7d5968e8399520290f47c161a5641aa8f9b8cc339bfce37680cf487997b19c37664462e7969871769a2bb711bc351646ae4e5fa3b7d0f97
  • SSDEEP 196608:GeIDlS1qqxmDwUpBpeme1fDlS1qqEmDwUpBpem6+ZBhgD7IRF:/duDHLe31g9DHLeLuBrF
  • TLSH
    T16966332EB66B71C5C6EAE23CAC35026047BE7616150B6E1B42FA5133BC7B0513D2DC9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionsvcstealerpersistenceprivilege_escalationspywarestealertrojanvmprotect

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • UAC bypass

    defense_evasiontrojan

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with NETProtect.IO

  • Detects executables packed with VMProtect.

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2