Extracted

Extracted

• • Target

    2025-05-19_ae448769b84e3b412336b99b08b90d28_black-basta_cobalt-strike_hijackloader_satacom

  • Size

    493KB

  • MD5

    ae448769b84e3b412336b99b08b90d28

  • SHA1

    563a82c0fd632c3fddde23fee726cf216112e717

  • SHA256

    06ff03ffd35acd3cf806a6b73992cb32e180e2b1fcdccb1cbe731b192d0b893f

  • SHA512

    c608ac94ab54c0ec31398473ae998028024dac922f7ca4fbae46428a1a6107551e7ba7393c22a228d6711a619d0adb449b44d89d8a813da99a6c6a406a526a28

  • SSDEEP

    6144:CP6d8nc4rHYrKm8qY0eBvLZlODKxSeJGcfxoBBzR:CPpc4rHYrKm8qYfBvnOE3zJ4R

  Score

  10^/10

  phorphiexxmrigdefense_evasiondiscoveryexecutionloaderminerpersistencetrojanupxworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1