Extracted

Extracted

• • Target

    2025-03-30_38531f553d3fbb005986a8dc1918a3d7_amadey_cobalt-strike_smoke-loader

  • Size

    4.8MB

  • MD5

    38531f553d3fbb005986a8dc1918a3d7

  • SHA1

    5094614a0de1fa6715f768eaa62aaaf71f5edddd

  • SHA256

    d6f91424d9ddcd934eca5d2e3fb65dba42b4c2ec3ce1a9f5e90f19e0b0b70dc6

  • SHA512

    c283afc7903eebc32daf2b297d9356c25c611c8355169a4ecc14e8a3ba2158917363f43a221836e704da42b256f90d70a854aebd14b402ce5004ef00cfe1d567

  • SSDEEP

    98304:Knsmtk2a9pCd614yoqkcpDcL6o2mpQ5ZuzM/Vy1adhZ0HMvP2JQgD8PFyJgRqTS9:ELCBVovcdcL9tpQezKVJdhZIS+JQgDm9

  Score

  10^/10

  metasploitxredbackdoordiscoverytrojanmacropersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2