Extracted

• • Target

    CHEESE.bin

  • Size

    2.4MB

  • MD5

    12ef571baf523c098fc4e96bb3759c21

  • SHA1

    b476dd2bed415fbbc9c96e4a33160d12bf8413bb

  • SHA256

    2180293a0c0b7340f85543d453c10e8f9a059b69a530428fe1858e92a7fa63c3

  • SHA512

    e4e2354ee21ede5f3a61c00ac9766736e55e23bd3577b5bc41a7f493b8143159ca8d771fad7af4ee4b7fd56be450b82651f0ce87b82e873119e9f1655ac7249a

  • SSDEEP

    24576:DYof7x+kxP2gEDiYbYXQZCsuMUTSyzdvi1ucvgDfR1JJMK3LTiF+cTl3RuQ5531C:kozx+kxugEaYu1JJMK3n/al3Q

  Score

  10^/10

  erbiumstealerxmrigevasionminerupx

  • Erbium

    Erbium is an infostealer written in C++ and first seen in July 2022.

    stealererbium

  • Modifies security service

    evasion

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2