Extracted

Extracted

• • Target

    2025-05-19_aa4dfc0e3c12dda0472b859129a0da82_black-basta_cobalt-strike_hijackloader_satacom

  • Size

    3.6MB

  • MD5

    aa4dfc0e3c12dda0472b859129a0da82

  • SHA1

    4a076f101a4f9ab7dda56322923e0c2ac62a90cc

  • SHA256

    0d959fc5cf64bfda22df007fbd93d9189c1b0cf2eff621192144bb71a680467b

  • SHA512

    09c5d03f4e186a41c3b963f1ae790e83265e982558391553b8440015209de1e560ca6864f7df50110ee294507ad7bd4a1df8fa640446b0a883cd90d208bef3cc

  • SSDEEP

    49152:R07ABNrf2SU0KSIp2yv8oOEfed2RMCQC8nXc5EikzXztCfU0yutc7EdbbHOMMKlS:R08yNFfO/nXc5Xk3t+Jb75MKpm

  Score

  10^/10

  phorphiexxmrigdefense_evasiondiscoveryexecutionloaderminerpersistencetrojanupxworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2