Extracted

• • Target
    2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar
  • Size 20.1MB
  • SHA256 64476622e882ab6953411889eac2eb280cd257cbb539285bc6c1a1d332f6b566
  • MD5 ee859206f59319637aa601fa41098b7a
  • SHA1 91a4c4a072bd93cb1d17553ed9e4d33f1831f812
  • SHA512 c7bbacb9dcf60eae566352399986861dc66ccff71c187b93f99e285c35331e41e3a65dee6b84ecfd10caf1fc5660b6c400c86581aea972c789ff814485a0520c
  • SSDEEP 393216:H4SvbbaX90TEZ4+xCuBkho4YbeGsFrSClVLLmXf9WVFid0B49iRqcQEUnZ5:H4AvI90TEZNCuGunaSClVLLmP8VFiEGX
  • TLSH
    T13227338B653871D8C166937B9EF8A32CFD7A60795B84380E0A6C85B4BF973344C65393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysolaris_loaderloaderpersistencespywarestealer

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2