93fe2b1cd53b5112ad7b5a44333c7b66ae0e03b08ffdf37662202ac8fb70ce4b

Sharing

Copy URL

Twitter E-mail

General

Target

NoxieGenV1.rar
Size

34.5MB
Sample

240619-rty67awhlm
MD5

de545acec932aa1786d0960e6cb84ef8
SHA1

e6ab7f6bbf0f7ec33d844a93efaed66ab58d54a3
SHA256

93fe2b1cd53b5112ad7b5a44333c7b66ae0e03b08ffdf37662202ac8fb70ce4b
SHA512

545accc93dd1daeda18cde0d313b6ef3f072195e7b4e142016a565baa0d96ea6dfb69916ed76d264fac2489f8766d813e18596318c26de3f0bda1c679602ec25
SSDEEP

786432:GHzqccwWMXqXMSDD91wodGissFkzsF13QyD6LSb0TEL+mnPpCQq5AgN0E+:GHmcRWs6Ma91+1z+9Qy3bRJkppR+

Score

7^/10

Malware Config

Targets

- Target
  
  NoxieGenV1.rar
- Size
  
  34.5MB
- MD5
  
  de545acec932aa1786d0960e6cb84ef8
- SHA1
  
  e6ab7f6bbf0f7ec33d844a93efaed66ab58d54a3
- SHA256
  
  93fe2b1cd53b5112ad7b5a44333c7b66ae0e03b08ffdf37662202ac8fb70ce4b
- SHA512
  
  545accc93dd1daeda18cde0d313b6ef3f072195e7b4e142016a565baa0d96ea6dfb69916ed76d264fac2489f8766d813e18596318c26de3f0bda1c679602ec25
- SSDEEP
  
  786432:GHzqccwWMXqXMSDD91wodGissFkzsF13QyD6LSb0TEL+mnPpCQq5AgN0E+:GHmcRWs6Ma91+1z+9Qy3bRJkppR+
Score

3^/10
behavioral1 behavioral2
- Target
  
  NoxieGenV1/NoxieV1.33.exe
- Size
  
  44.6MB
- MD5
  
  cdfabb41dc5991abd7af0be63ff903cc
- SHA1
  
  3c4d9108dd3f7d66459a0bcdf8117e66018bd077
- SHA256
  
  28d9bea8276018975660f1c6003112229d8baf1cd5894cb068563a7ef4557d9b
- SHA512
  
  3c200234d8bdecfa82ad42423606d7d66780c5473448f8ac80a2207c0aeeabc72799bef4816ba98666cc68f0440bb97e6fd65451883f3bd17f453a4d154e5299
- SSDEEP
  
  786432:TlWJZZljcVY3U5MBkt7oxDLR7MTL9770cAkYz9QEiabCHVxV7qM3kXC3s1bmTeyb:TMTvl3UGBk7oldAtvYzqaboxVOsTTzv
Score

7^/10

persistence pyinstaller spyware stealer upx
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3
- Target
  
  NoxieGenV1/assets.dll
- Size
  
  5.1MB
- MD5
  
  773b3b72481fd8ef9b62b5ef0fe8040a
- SHA1
  
  a42cbc7aab88689e834c158b24af8722586cf1b4
- SHA256
  
  7f93fef11819a9f4b8edd342a1c2d3dbab25698ed75f9713ee1167fa2f852331
- SHA512
  
  db7d29100060afc909cbf20bcd6d9c02fc0b29d8ee32606e2d6cf18270484f2b46853cda0b495a85cc7a2e3ae4536030a25216f101dceabf2f972e3375208c38
- SSDEEP
  
  768:+UI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUIn:3
Score

3^/10

execution
behavioral4 behavioral5
- Target
  
  NoxieGenV1/instructions.txt
- Size
  
  225B
- MD5
  
  11f5f5a027e645143c8662e6d4a96c10
- SHA1
  
  f67ef7b75ef80f9bd358f725931d08235dea4d7e
- SHA256
  
  23368dafd254f2b5637b57e91d88196cd0325e8c9c710c1c67e1bb174ef970ff
- SHA512
  
  b47c1248ccd38d00a72c2f39892ac840ceb56ef7f075dd2fe1a2fffceefc1b96c65f95941ce77525c36dbf1ca625985843df91a4e189752f9c500f825aa58270
Score

1^/10
behavioral6 behavioral7
- Target
  
  NoxieGenV1/license.txt
- Size
  
  6KB
- MD5
  
  0b09566254b011d989decf0e23a902eb
- SHA1
  
  3ae5cd6be73daf418b8deee9c865cf78225838c9
- SHA256
  
  a19d58aaab15c4d0019e569d1c073d1b5286fdd37dbeee7a58a7d1ae76045ae1
- SHA512
  
  4e22e58f925879306261e5993039e1d84d87f8fecc0f9fdad534da55b6fd22be77e622a4077d8d521f7734e5535f66853d581155987e2f3607e2d386938c218b
- SSDEEP
  
  192:uEwjuKsgA4+XYdXjA+okS63vZBCSUziJm:eNs8+QRVxBRU1
Score

1^/10
behavioral8 behavioral9