Extracted

Extracted

• • Target
    2026-09-23_4a957069c7ae5f2f6e775409c6a992d1_cobalt-strike_icedid_satacom_vidar
  • Size 59.1MB
  • SHA256 71c000009ccc00dc6b8a8e73c7650d145b73bd048646ce68e4566aba7ea63d83
  • MD5 4a957069c7ae5f2f6e775409c6a992d1
  • SHA1 d301b9402a75f9412c3a7c101b394dbaa4c19aba
  • SHA512 9d35af365c4f087d7e3de0a4440631382862565bb7495e4d925c6332cef9d60c62d9bc59002dfde8a5225dfff3367b223cd261146b1d78e4f874cdafc47e0b5c
  • SSDEEP 1572864:4DTKLvrwPtTPDBtQ7N9DHYOhYxly5Shv3+h+:ZvcPtTo7LHYOhsly+3+
  • TLSH
    T14BD7336D2D3A1C7CF826E1BE0BE982653A80B7D1BD64D339CE7202DC6D69195C79B340
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  20x09x2026defense_evasiondiscoverysolaris_loaderstealcinstallerloaderpersistenceprivilege_escalationstealertrojanamadey

  • Detects Stealc stealer Version 3

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detects Reflective DLL injection artifacts

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2