Extracted

• • Target
    2026-10-05_0112f1cffd646ed0818c3088ab50ae8f_cobalt-strike_icedid_satacom_vidar
  • Size 42.1MB
  • SHA256 4902684357fbd82d08c155eac5ea598fcda0446f408294fd8a18085d7ad1ac73
  • MD5 0112f1cffd646ed0818c3088ab50ae8f
  • SHA1 d1f36ea80e20f9d6435c3975a2f59cc4c4d6e626
  • SHA512 dc8232c242fe59bf2c9c54c587c394b29191de6a6adbe9a16c7b9dfce72c0436bacb3d997a5dfc124f6186742b44fd58296a34628750daaedab34ec360d57d5c
  • SSDEEP 786432:9Ykga3uUOqT4eKdeSvMYEj9+xDnWoOA6ef9C2MDNXDD2RpZW7hbOaKlLVeZ:9YkmUOw4eKdHvojcRPOA6CUD8RrGODS
  • TLSH
    T1D7A7333AD3C0D961EC263936CB345215F5F55E128FC8902A9378EF9AB53FC899E18790
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationpyinstallerstealertrojan

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2