Extracted

Extracted

• • Target
    2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar
  • Size 70.5MB
  • SHA256 5a5b14dee63553fb7f57baff9759c8a93720fe56e84cef72395913f34729b3d7
  • MD5 4dc6b4264577ccae0b00328e37d77984
  • SHA1 8152990737717184df5493ab316d3e987dfb73bc
  • SHA512 f9bb51665d6d8dd3383110b80710cba5af9f50ecb015c83d84c28f6795635075ac9ecd0ac4631666416d56e697c9259b6f296a8e6057e2277be193cfc3a49734
  • SSDEEP 1572864:YuKKUb4L1akqtFUm1mm+KTZhZhXKoWeB3h0RQjE6lEHRqucrc:/KCakqj1h+KdhyViCRJ6OHR
  • TLSH
    T160F73398015FE0B5E5229370C028EB719D03789E971A853F1534688E3BE35BACDDA7DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationspywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Custom signature

    Detect binaries embedding considerable number of MFA browser extension IDs.

  • Custom signature

    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Custom signature

    Detects Reflective DLL injection artifacts

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables Discord URL observed in first stage droppers

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables containing common artifacts observed in infostealers

  • Custom signature

    Detects executables referencing many IR and analysis tools

  • Custom signature

    Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2