Extracted

• • Target
    2026-11-06_d08b3ab50bb669247fe8d86eaade9d79_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
  • Size 3.8MB
  • SHA256 a7ee68acaddc34982039ebc8566b35029985f7991f217bb1c1bcb2863600dea1
  • MD5 d08b3ab50bb669247fe8d86eaade9d79
  • SHA1 83e596d299d6ae972280105f731358940793e2eb
  • SHA512 b550da1254e17ea01e0b0203342bae45eda3cf17f736bb0a5e4b774979a864649b3d9000daf834cc4e0ba51f73840e775b7568f225753c6783a3d35535135c2b
  • SSDEEP 49152:gPANVub829XhXyqmR0nIKaI9/B5CasS0jB+hrlk6d+5VL64qxQ:YxXVi0nIKj3syi6d47qxQ
  • TLSH
    T117162A92A36501B9D81ECCB4CE2D941297293C8E43F193FF25E876E51A729C97B39F10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2