Extracted

• • Target
    2026-09-27_2501741b923d13438209103d692be2ea_cobalt-strike_icedid_satacom_vidar
  • Size 16.2MB
  • SHA256 9c98ef39715059bba7f2b99e459ca98cb5c14bec971ea55dd85fad1140f8d2bc
  • MD5 2501741b923d13438209103d692be2ea
  • SHA1 f913d8e24b0cc44bd54d28d748d053ce925ed44d
  • SHA512 c703de5e9b004556f1c6274c73dbedd7cf5badd4f325a25f0e99c5783f8e6359dd6f3eb8874db8a1496dfb85b698673de2423790aeac35b44e36acc37972e45e
  • SSDEEP 393216:mJvdVFh+3l3Y7My4QtgEZOtd+r0UXqx6xJlQW:SdVkzhQKN8j6yD
  • TLSH
    T13807330018D72CC9F527E7FED94116099EBAB6606608929EAA7A4F5A1F3F173C177330
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionsolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationstealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2