Extracted

• • Target
    2026-07-30_dc9efc9d5eb6891f00086e2d9d53c189_cobalt-strike_icedid_satacom_stealc
  • Size 256KB
  • SHA256 31b7c84f0cd9bd1da3c9b01bc85da630cf59995290e23aeb99ea6335aad3df40
  • MD5 dc9efc9d5eb6891f00086e2d9d53c189
  • SHA1 6646febe2b18b500ac77169677942b57d0da6f4c
  • SHA512 1a18d53f51dcc568afd7ac18d65e885487e6e18f3dafe701fcca77f443c55be1f51c426dd6121dbac359b743e3f2110985d717ce7e93d782159b01e4fa997425
  • SSDEEP 6144:7FZgqzfouPEN/ORDA7BMmZqzckaa9kb1:RZbENGRDIMU8ckaa+
  • TLSH
    T12B445B15B7A40CF9EA77877DC9C24906DA72BC564760EACF03908AE64F236D09E3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxmrigxwormminerpersistencerattrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2