Extracted

• • Target
    2026-09-13_383f0c5119f612aa45b9691a7c47aef4_cobalt-strike_icedid_satacom_vidar
  • Size 17.1MB
  • SHA256 181b80c3a23bc369270a50c892104d258aa0805ea03efadc8e4eb3317ae23417
  • MD5 383f0c5119f612aa45b9691a7c47aef4
  • SHA1 eed59abf614595526bbdd4573ac28f67b5574dba
  • SHA512 06cb5758afedfca18407d4edeff64de9b4f11afc7bb09aaeb3a1a02c225522324598d7ee19de70b7d62c24f0b8c5fc5c4baff1e9ce76bc12ae2b7f74654cb500
  • SSDEEP 393216:d199UbtKPWZhDoDZSxTrb2vgfWE4gNgaIo7/CNoj8h/nicCi:dubtqUNG8xTXnWaP76NOo/iI
  • TLSH
    T17D0733F1B698256FC5E40D399A692633AFD87330CA16BF7902D17E632E251D0AE0FD11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  droppedcredential_accessdefense_evasiondiscoveryevasionexecutionexploitstealcpersistenceransomwarestealertrojan

  • Detects Stealc stealer Version 3

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Turns off Windows Defender SpyNet reporting

    defense_evasion

  • Detects Reflective DLL injection artifacts

  • Detects executables (downlaoders) containing URLs to raw contents of a paste

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Drops file in Drivers directory

  • Modify Registry: Disable Windows Driver Blocklist

    Disable Windows Driver Blocklist via Registry.

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion
  behavioral1behavioral2