Extracted

Extracted

• • Target

    2025-05-19_2816b4bbc8a46cdc97448f2acd41d0fd_black-basta_cobalt-strike_hijackloader_satacom

  • Size

    3.9MB

  • MD5

    2816b4bbc8a46cdc97448f2acd41d0fd

  • SHA1

    4f3212eb43de673af8960692776efe0b0f070c45

  • SHA256

    89121a03c69ebc751de4d4dd1c6cdb2f11c0febb6bf59c740744a7fe58f38d41

  • SHA512

    878cf9c11ecf5172ebfc49aacbbd8473f2c9312e0dbc78355d1f457fbd738ff5203b36eac915405edc4a952e6b4adee8e6d1feb38b14b80d7fa1a7bb3ee8ba36

  • SSDEEP

    98304:XWaVOBfKE4QT41wUbqP0AxVSYIuU+LzmT3YaWIpTTr3dwBkR17:Ga77Q1OqP0AxVSN4zTaWIdNbR

  Score

  10^/10

  phorphiexxmrigdefense_evasiondiscoveryexecutionloaderminerpersistencetrojanupxworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1