Extracted

• • Target
    2026-07-11_9ac3fec07577acf162fe418b3647b6d7_cobalt-strike_icedid_njrat
  • Size 762KB
  • SHA256 915f00c248661afc00da7ab78be0b64470ae08cddc4d5bb890553b928e14ca10
  • MD5 9ac3fec07577acf162fe418b3647b6d7
  • SHA1 ede019e093715a0df473fef032e5c5ac67e01d48
  • SHA512 4ed81fb34ea5ca337b6f5ad68e441183af68d24d487a38d64b23701b67b246e72c178f643f7d7f306049b943912c49b38a7a2a5e52dffc436f21acadd13e8cac
  • SSDEEP 6144:5S412MHH6zeRo2L3fLlD9C2IKdMPtJq7wUIP3rX8em5DlRqj0uRP1tWXsME:041ln6zOL3pD9QKdOtJ73rX+5xIjWX9
  • TLSH
    T148F4AE61A3D802E2E077C2BD89D98B86D6B278140B309BC746D462993F23EF55D3F725
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistencexmrigminer

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  behavioral1behavioral2