Extracted

Extracted

• • Target

    rar/UnRAR.exe

  • Size

    494KB

  • MD5

    98ccd44353f7bc5bad1bc6ba9ae0cd68

  • SHA1

    76a4e5bf8d298800c886d29f85ee629e7726052d

  • SHA256

    e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

  • SHA512

    d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

  • SSDEEP

    6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK

  Score

  3^/10
  behavioral1

• • Target

    start.bat

  • Size

    100KB

  • MD5

    45ccb4e03696834d0852bb90f65e3629

  • SHA1

    0d67056066728699a323f63510cdadefc9504084

  • SHA256

    7e0903c4f236d2e0e92522ede6284ea24464af4e86c812cce72e897bb2a87754

  • SHA512

    0c30ab9c768d378d29ad4fdc16d3321038dc71040d041deb8604751f950691aef8a2e6c817578db9057ffb0460f3b3b97f44488f884b2fd7b18f0bde9f2d4561

  • SSDEEP

    3072:9AP7YD2E0xfyQZbsRdwNWuiTvEoryDJV9MTtnI3:9A8D2x66sRdwku+T4MTtI3

  Score

  10^/10

  phemedronexmrigevasionexecutionminerpersistencespywarestealerupx

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates new service(s)

    persistenceexecution

  • Drops file in Drivers directory

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral2