Extracted

Extracted

• • Target
    2026-08-10_776fa117222a72b65c855dfa08edcb7c_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 2.6MB
  • SHA256 7c6c0f35c36de3c0d4540c2d7ff0c945677297e85995781bd7ab0cb952814465
  • MD5 776fa117222a72b65c855dfa08edcb7c
  • SHA1 8b67c7487c2df857388daf7c449345e80e03a3e5
  • SHA512 46624b347c5e6d72976c0ea8113ef104eb13faa63bf2de360b927fdc7f7765b443ee148a335991a374a1f59891f222804b5db7e5a14cf239e5833a03a50a25ed
  • SSDEEP 24576:KzAPXCwCK7uHfyPk8oHinTR8+3+qsM9Y7nVLuEnip8Bn6:gEra/yPHMAqy+qscSnEEU8B
  • TLSH
    T1EDC5F73E251403DCDC5DCA3A98CF25D9A050322C92381FBFF1945E315EB6AA93BE5687
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsalatstealerxmrigminerpersistencepyinstallerstealerupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • UPX dump on OEP (original entry point)

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2