Extracted

Extracted

Extracted

• • Target
    2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar
  • Size 69.1MB
  • SHA256 1fc4d0391340886199bdc18c663fdcb6bbaabfddacb1c7dac7da9e1f45a86393
  • MD5 7dbc301e3b4d2899c12576693696858e
  • SHA1 5c0402c2ba82d4e5ac1e8c49c91a1713efaac962
  • SHA512 ed38a14bad50c5050e3b1943f3af8f331ab1c0f0e2351d22bda5b7db18cfc21371b31faab449e5335cedc057036778d6fcd35fe40cbd5f55eeeb8b45ed22f2ff
  • SSDEEP 1572864:mPR7r9Ci23WEWgBEC86HziOrtRgaYgjghHh5for5LqiwFKY:Qdr9Ci23nEC86HziuJ8h5fo1GzFKY
  • TLSH
    T1C5F7336BA294BC80C90380760AC05BBCC7A5B53D5176D8FDE7A625CAB92D371073BF91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  rundefense_evasiondiscoverydownloaderexecutionsolaris_loaderstealcsvcstealerinstallerloaderpersistencestealertrojan

  • Detects Stealc stealer Version 3

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Reflective DLL injection artifacts

  • Detects executables Discord URL observed in first stage droppers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2