Extracted

Extracted

• • Target
    2026-09-22_9401f18fca38ad116c39558b653fd941_cobalt-strike_icedid_satacom_vidar
  • Size 87.4MB
  • SHA256 961d700d922828621763dfa9ef93fdbf26cfad7749ac747926e8a728c9dc98a1
  • MD5 9401f18fca38ad116c39558b653fd941
  • SHA1 6aecc632316bc31dedf582c6f6a6b63a2802aea8
  • SHA512 2cfd6491e6d5e8bd9825d2083b7603b27a5b8bdca3db001fe483473064ef80a95042c36dd73e97d5317aa57468fd94a4128cd3fc5a985115695f4d807783119e
  • SSDEEP 1572864:du6/17lAePygrRT6k0qxcs674axoSeWKf6lvExmuFfBEySBc:k6/1dRT6kGs6kaxXuChitfl
  • TLSH
    T17418333616E318E4D09D56FE22306EA24974E70C70D195BA5FE69A1C7EC30825FEC6B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  20x09x2026discoveryexecutionstealcinstallerpersistencestealeramadeytrojan

  • Detects Stealc stealer Version 3

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detects Reflective DLL injection artifacts

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2