Extracted

• • Target
    2026-09-08_83803beb0ddf793b9dc073847cc3da85_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 1.6MB
  • SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
  • MD5 83803beb0ddf793b9dc073847cc3da85
  • SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
  • SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
  • SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
  • TLSH
    T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionstealcvalleyrat_s2persistencespywarestealer

  • Detects Stealc stealer Version 3

  • Detects ValleyRAT payload

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2