Extracted

• • Target
    2026-10-13_dd8f760cf907ffa074219a2283271d37_cobalt-strike_icedid_stealc
  • Size 416KB
  • SHA256 3c120352e2a94400324053a24dd40b937878b6f8639675530a98c6637256f5c2
  • MD5 dd8f760cf907ffa074219a2283271d37
  • SHA1 31d504e745c2fa857f2b9f61d24b2c9fe973d7ff
  • SHA512 1aa98a709446aa9fb306edb3e83101421625d442b58127f901e23f3838b8dbe715a5e69b570d00780bcfb31b140bd93ae25951762e028aefdc54efc32c4a8fc5
  • SSDEEP 12288:7l5S1AyuMMhixIoYblzdMr7CEakQGdpU0WyE0z:Z4nchMnI4pU0WyE0
  • TLSH
    T1D894F15B73A130FCE17B9635C4A10A09DB75B4B627749BDF07A00B592F635E08D3AB22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  office04defense_evasiondiscoveryevasionexecutionquasarvenomratpersistenceratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2