Extracted

• • Target
    2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 354KB
  • SHA256 89955ba038453d67183cca7f001b450ef8b8737f92ccd67739d0444104e5962a
  • MD5 0095b0b6207c84c25ab91f6b11b6a0ba
  • SHA1 77f2d425121275a5cdbd008298d050cd30e71662
  • SHA512 10ae8af08034a6c5b0f2043f23da286aa5a94d73f1e7fadb575a4493ac8d27284a159e667c8c7884d5adec15f8a3740ed307e1dd430009f893093946af4d0aaa
  • SSDEEP 6144:jFLTjxYMATKo9SjY9tIu10H0UYRQGyyfTaVFRV3:dTjsR9tIuC0UYFv2
  • TLSH
    T19A741722A6D83CE9E57A827CDB7347C1D72ABC060760D6CF13D019662E3B6D1793A790
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxmrigxwormminerpersistencerattrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2