Extracted

• • Target

    3c7a0be285dba90759f4ae5c8257b77a.exe

  • Size

    7.9MB

  • MD5

    3c7a0be285dba90759f4ae5c8257b77a

  • SHA1

    20043abc1660d83b99a7858712832ce0df023c21

  • SHA256

    71bf6ded75f3a049bc1064e200fdf3956c0f647a073b8af48021626e9a46e933

  • SHA512

    0fdd37f15aa3ce727b6adf11570a035d475f99a9dbabd5db680e3f9f35c2dc261d4a08a6aae5955662a7d92c6d10db2c9b147ad109addb3abf9d69cef1bcf1e7

  • SSDEEP

    98304:YtEdYr+IjnsMAtp3Jrk6ILOANFnaYXUyIcgEc6NOO2YVt8s0ryW0eA5:Yxrxjnap3wLOGzUzcEA+s3n

  Score

  10^/10

  cobaltstrikemetasploitbackdoortrojanxmrigminer

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2