Extracted

• • Target
    2026-11-08_61c87dc5002fc9f9b52609ffb0200827_cobalt-strike_icedid_njrat_satacom_stealc_vidar
  • Size 1.2MB
  • SHA256 aaa03e93727f6037b84a0b428c345e76a9c1c9d159fa324343db58159d642e41
  • MD5 61c87dc5002fc9f9b52609ffb0200827
  • SHA1 2a7a90ae2b2dc43c4aeec7304ba3d21e13f9a475
  • SHA512 b917131144e866b9945facba57000fbb61b17dfa50fb6b6b7f115050fb54f8877e0d901120a1bdd1b3e56552be7f423494c2abeb6d55e88d927b6ac996ae45b5
  • SSDEEP 24576:16sFRjB6uhSsl95CJNRk1yLZhnHEOQUq/KaGkM:16sFRouhsRk1ghHLQUq/Ka
  • TLSH
    T18F555A466E9BC5E9D17BA17FCA460E02D5BEFA01031396CB0B905A753F13AD30D7A3A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2