Extracted

• • Target
    2026-10-01_ccce74fe1b4f0deef687b7f374d392f2_cobalt-strike_icedid_satacom_vidar
  • Size 15.4MB
  • SHA256 4735c892cf28f5fd5fb700ecafcbfbe614122ec5d2daa584a692b2b81aa17f6c
  • MD5 ccce74fe1b4f0deef687b7f374d392f2
  • SHA1 2310ca6a3cb15be85df06dbca970f81bc70c1fe6
  • SHA512 586fcc5b0e71e78629a79ec83357d714b27803d94c7a37477d3f6b510d8fae9b11bc3dcfeca73bce273ffeede8d81ddedefeb0e6484981485ae8f4757bab14ad
  • SSDEEP 393216:O/6HthRZ6GxC8AVo6YSqwJRydqpYMIMGTAkEoAMHykz:C6ZZDpOhJwlMgTAkbAMHykz
  • TLSH
    T1C5F633D636A656C9E8BB12799471271871293C112F853ACF43D89AF82FD21E0FD0BF61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionsolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationstealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2