18d08cd098a4d86088762fb71b8a392e5e3b53667ec112274a424cf090cad48a

General

Target

NoxieGenV1.rar
Size

34.5MB
Sample

240223-b61yjsab29
MD5

418e977a034b323aec25c7b3d771d245
SHA1

afd1ffe2685a08aea4b6f2ff6f91c58d92f689dd
SHA256

18d08cd098a4d86088762fb71b8a392e5e3b53667ec112274a424cf090cad48a
SHA512

42a677fdfe9f6452c90034c0e2f69afe3c2d90660cd0ad06c0ff702c104d4034df05b52ded9a8618474e9b650993b3d8a92523e7014d86609a3807723984120f
SSDEEP

786432:sIbB40OzoSpmi/INTF6Rf4GI80oRSwlXcTse142X1IBJUWM:sIbB25miKMf4GI80wFcT14IgJUz

Score

7^/10

Malware Config

Targets

- Target
  
  NoxieGenV1.rar
- Size
  
  34.5MB
- MD5
  
  418e977a034b323aec25c7b3d771d245
- SHA1
  
  afd1ffe2685a08aea4b6f2ff6f91c58d92f689dd
- SHA256
  
  18d08cd098a4d86088762fb71b8a392e5e3b53667ec112274a424cf090cad48a
- SHA512
  
  42a677fdfe9f6452c90034c0e2f69afe3c2d90660cd0ad06c0ff702c104d4034df05b52ded9a8618474e9b650993b3d8a92523e7014d86609a3807723984120f
- SSDEEP
  
  786432:sIbB40OzoSpmi/INTF6Rf4GI80oRSwlXcTse142X1IBJUWM:sIbB25miKMf4GI80wFcT14IgJUz
Score

7^/10

pyinstaller spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1
- Target
  
  NoxieGenV1/NoxieV1.32.exe
- Size
  
  44.6MB
- MD5
  
  df719e49521493180856de7248c797de
- SHA1
  
  d8c6088dac1cba5d03563438d1f66d4a06aac768
- SHA256
  
  c93135add65f328fa7a9c599bfbcb6b486b047215b0500dddc06895035749629
- SHA512
  
  05ba86e13d730bdf25db74430f2f471751d8248fa60d2abcd861b803b265f7f39ac3151e978a162c431b2743a6557625950b91bdf8490fc64a925977d54ff96b
- SSDEEP
  
  786432:LmB6y6uVOV4YBdPePvOyZU3fKe5x8gkXWbSDW8rkPosRahBNEAsF8Gt3Fzb:LmB6yVcVTPmrZafDcXM/5RWBjkJ3F3
Score

7^/10

persistence pyinstaller spyware stealer upx
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral2
- Target
  
  NoxieGenV1/assets.dll
- Size
  
  5.1MB
- MD5
  
  773b3b72481fd8ef9b62b5ef0fe8040a
- SHA1
  
  a42cbc7aab88689e834c158b24af8722586cf1b4
- SHA256
  
  7f93fef11819a9f4b8edd342a1c2d3dbab25698ed75f9713ee1167fa2f852331
- SHA512
  
  db7d29100060afc909cbf20bcd6d9c02fc0b29d8ee32606e2d6cf18270484f2b46853cda0b495a85cc7a2e3ae4536030a25216f101dceabf2f972e3375208c38
- SSDEEP
  
  768:+UI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUIn:3
Score

1^/10
behavioral3
- Target
  
  NoxieGenV1/instructions.txt
- Size
  
  225B
- MD5
  
  11f5f5a027e645143c8662e6d4a96c10
- SHA1
  
  f67ef7b75ef80f9bd358f725931d08235dea4d7e
- SHA256
  
  23368dafd254f2b5637b57e91d88196cd0325e8c9c710c1c67e1bb174ef970ff
- SHA512
  
  b47c1248ccd38d00a72c2f39892ac840ceb56ef7f075dd2fe1a2fffceefc1b96c65f95941ce77525c36dbf1ca625985843df91a4e189752f9c500f825aa58270
Score

1^/10
behavioral4
- Target
  
  NoxieGenV1/license.txt
- Size
  
  6KB
- MD5
  
  0b09566254b011d989decf0e23a902eb
- SHA1
  
  3ae5cd6be73daf418b8deee9c865cf78225838c9
- SHA256
  
  a19d58aaab15c4d0019e569d1c073d1b5286fdd37dbeee7a58a7d1ae76045ae1
- SHA512
  
  4e22e58f925879306261e5993039e1d84d87f8fecc0f9fdad534da55b6fd22be77e622a4077d8d521f7734e5535f66853d581155987e2f3607e2d386938c218b
- SSDEEP
  
  192:uEwjuKsgA4+XYdXjA+okS63vZBCSUziJm:eNs8+QRVxBRU1
Score

1^/10
behavioral5