Extracted

• • Target

    2025-03-28_f4272142fabfa439b076bbf3f99e4fa0_amadey_cobalt-strike_cobaltstrike_poet-rat_smoke-loader

  • Size

    5.9MB

  • MD5

    f4272142fabfa439b076bbf3f99e4fa0

  • SHA1

    0cb3c6df1e4e3900efca482a33cf39e32a758cbe

  • SHA256

    75fc3b04744b761589bdb66d878c00f0fa9e1d2511b6e4e26e65c45bc00caf0f

  • SHA512

    31c9934593e8d528b511a9a436cccf76f2e7b83f13a6c1bd7641c53a1761f4a84324ef5f22589fc2365aa1310411550fd6b02a658ab2a8d73d8f01639dccc1d7

  • SSDEEP

    98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUh:T+q56utgpPF8u/7h

  Score

  10^/10

  cobaltstrikexmrig0backdoorminertrojanupx

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2