Extracted

Extracted

• • Target
    2026-10-22_3525ad6025fdc20bb0a4edc427ac9ba8_cobalt-strike_icedid_satacom_vidar
  • Size 16.9MB
  • SHA256 da8cad8659eedb5eeb026d74b0c448da957ef172c371b9fca50d1ab71a04ba22
  • MD5 3525ad6025fdc20bb0a4edc427ac9ba8
  • SHA1 ab4d856384c1077f25e237ac05d5b3a7040935d0
  • SHA512 483118a73c8c03b3ab87e0d48a60371c9f82e3cf61c153ba7b0ac179075da5c53ffca7f17087ba025f608e2d09103def6ad63a3c4d15e30b0b522c5a0c439fd0
  • SSDEEP 393216:gsRc4RjNIOqwjkwAUvR3POsAk5NCE6YnOL/IHtANRBsdy:SEBhOsvhC/IHyB8
  • TLSH
    T18D073371B4901C57FE8188B958B14704E6AD773AB8054FBFFA9C33583F9E8984F16891
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationspywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2