Extracted

• • Target
    2026-10-01_9d96fea08592a76d45e5b4f073e42f7c_cobalt-strike_icedid_satacom_vidar
  • Size 22.2MB
  • SHA256 5e647c3e5a2350c7d2b17c1cc6132c6a210f7225edd2012272467d0742e8b084
  • MD5 9d96fea08592a76d45e5b4f073e42f7c
  • SHA1 86c9f2944754aef3e62b0e79da0b101360d5e091
  • SHA512 fd7c67caffd4b0a42b1c34f4e07d86a62247be3d4decf4c7bcf8c5925e29db3d31f5b09ecbfe5b0e7ba70ef6f9bd912375ad5bfa54b5cce3aff1b00b4fa6a622
  • SSDEEP 393216:9WDCDO79YvwngSS/Ki71dvIP3HnARdzFeUZSeK2iWMgEu34FGpv58WEJtKhK+:SCDOWvwS/ddIPIdzFfS9yz6Mgw8
  • TLSH
    T13D37337EA4D444A2F72289BA2119C223A357FE57568FE71F56E03C4BBA173C1848B353
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionsolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationpyinstallerstealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2