Extracted

• • Target

    2025-03-29_ed792723ba21a8e0d0cc25cb5cf66c46_black-basta_cobalt-strike_satacom

  • Size

    37.3MB

  • MD5

    ed792723ba21a8e0d0cc25cb5cf66c46

  • SHA1

    effafd6d4b2ea916a4633c7065d84beb806386e7

  • SHA256

    c92d1b2c314fb70cc2f150b5bd5501291c4019cfc41c1a6f414401b1530e6be8

  • SHA512

    67dd677ec19c8462aa1dd24ed95791c20dcd1fdaf67a3daa673d8ebc353013130f7d77ac428a650303abfd81a20d860d6e53643c198d2450f78b43e71f4bedac

  • SSDEEP

    786432:upuNz0ZyK9DRNFOCWQnTzHTWg9DhGsVDHXMb8ODw05q4WUXE:upSz8yKiuHakDcbqv

  Score

  10^/10

  aresloaderdefense_evasiondiscoveryloaderpersistenceprivilege_escalationupx

  • AresLoader

    AresLoader is a loader and downloader written in C++.

    loaderaresloader

  • Aresloader family

    aresloader

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2