Extracted

Extracted

• • Target

    2025-05-19_54dd73aaf4333de1d6b752970053f97a_black-basta_cobalt-strike_satacom

  • Size

    2.4MB

  • MD5

    54dd73aaf4333de1d6b752970053f97a

  • SHA1

    f73f829ee8be141221d16f060899a24401aa296d

  • SHA256

    4c862050977af943ae12d836fdfbf26ff3e1a9c780c8b26a7fa0e414a266fce8

  • SHA512

    04fa3c8a80908444af78548677f1f64dbb9c8e867f4b3262c7e91dc6c91a241256b87d5b0a87914457f7084b4750ebd39e2328dba0df33f0f3771a61eef19d6b

  • SSDEEP

    49152:tMMxWUOeZ1ziinxbGcE1ryZJba2qsrcSh7BrK1ldN6fzf+m66z:y1k/h7EzdN6D+S

  Score

  10^/10

  phorphiexxmrigdefense_evasiondiscoveryexecutionloaderminerpersistencetrojanupxworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1