8222e1a34e592ec3dc0fcf6c6c636200487a6a5b082939e3c1cfbd7d8435d1f0 | Triage

Sharing

General

Target

2025-03-30_c3915238ef3d1c6c4df03d00601735ee_black-basta_cobalt-strike_satacom
Size

16.3MB
Sample

250330-xk2tlsxjy2
MD5

c3915238ef3d1c6c4df03d00601735ee
SHA1

b77c82278c507149a66f95c014807e93a26c5e16
SHA256

8222e1a34e592ec3dc0fcf6c6c636200487a6a5b082939e3c1cfbd7d8435d1f0
SHA512

a22690f27f0650f5a97e9eeb159df1a83daeb02f5ae8bcc3d1e8698799af5c0aa1a45f0ae0a2605ba6862d5a117f7da71ef4dd94b4fee46ee2ff81c8c1c2aaf4
SSDEEP

393216:TfZaKBsRvKCYL31x1R2JtWNhqKVNXMCHWUjfVg74wmMIC5/w5HK:NaKCGpR2JtEhqKVNXMb8tDwmTC5o5K

Score

8^/10

execution pyinstaller

Malware Config

Targets

- Target
  
  2025-03-30_c3915238ef3d1c6c4df03d00601735ee_black-basta_cobalt-strike_satacom
- Size
  
  16.3MB
- MD5
  
  c3915238ef3d1c6c4df03d00601735ee
- SHA1
  
  b77c82278c507149a66f95c014807e93a26c5e16
- SHA256
  
  8222e1a34e592ec3dc0fcf6c6c636200487a6a5b082939e3c1cfbd7d8435d1f0
- SHA512
  
  a22690f27f0650f5a97e9eeb159df1a83daeb02f5ae8bcc3d1e8698799af5c0aa1a45f0ae0a2605ba6862d5a117f7da71ef4dd94b4fee46ee2ff81c8c1c2aaf4
- SSDEEP
  
  393216:TfZaKBsRvKCYL31x1R2JtWNhqKVNXMCHWUjfVg74wmMIC5/w5HK:NaKCGpR2JtEhqKVNXMb8tDwmTC5o5K
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2