Extracted

• • Target
    CHEESE.bin
  • Size 2.4MB
  • SHA256 2180293a0c0b7340f85543d453c10e8f9a059b69a530428fe1858e92a7fa63c3
  • MD5 12ef571baf523c098fc4e96bb3759c21
  • SHA1 b476dd2bed415fbbc9c96e4a33160d12bf8413bb
  • SHA512 e4e2354ee21ede5f3a61c00ac9766736e55e23bd3577b5bc41a7f493b8143159ca8d771fad7af4ee4b7fd56be450b82651f0ce87b82e873119e9f1655ac7249a
  • SSDEEP 24576:DYof7x+kxP2gEDiYbYXQZCsuMUTSyzdvi1ucvgDfR1JJMK3LTiF+cTl3RuQ5531C:kozx+kxugEaYu1JJMK3n/al3Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  erbiumstealerxmrigevasionminerupx

  • Erbium

    Erbium is an infostealer written in C++ and first seen in July 2022.

    stealererbium

  • Modifies security service

    evasion

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2