Extracted

• • Target

    sdcheck/SeedsChecker.exe

  • Size

    10.5MB

  • MD5

    5f7e0d25b165b9afcc3e6ca2bb135a47

  • SHA1

    72cbc2583a2dd5078a0edb83b153f38fb5ddb085

  • SHA256

    b94bb64c9f1e39f900c095b2034d3302a2a1cfeca08096ac71ecd24b5a25c61d

  • SHA512

    fd87ba28b3cd39b7938eba27d95588cacb51dd3e46c5f79282f3a2693e78387c1032b58b1186eae052a4d33680863c609588888dff46a3fb2542860eda4329fc

  • SSDEEP

    196608:BVE0qzgg7MlG6g4kpQbjHqsQLTJeriQAu8VAbC7EzpIjtoTSam0nuYaf:BV5qz7J6gKbjq1d4iFuE+CQzpI2+l0nu

  Score

  10^/10

  asyncratxmrigdefaultcredential_accessevasionexecutionminerpersistenceratspywarestealerupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Async RAT payload

    rat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Drops file in Drivers directory

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1

• • Target

    sdcheck/module.exe

  • Size

    40.1MB

  • MD5

    926853fdfffb1a4645f22bb5b7e10d71

  • SHA1

    8cfddabdd2d38175a51cd228b0a25ea0cec6f043

  • SHA256

    bde124a6ff61b44ca4313c5860535cb2b49693e602eee6746b3af7dec5623c17

  • SHA512

    64cbc3f1dc1a1c6f36df0277c1d96da2f5d3c1265149e425f9d6063015d78e96c4b604aeb6e6734a01140ec5bf4d925d1c4c2130f43f1f9e5ab432583c4630e8

  • SSDEEP

    786432:yFNHjOvEt1KXZfKXZhu14yyGifQARGMbExzZAZktBbNgx:yFNDQEaiq184A8YE5yYy

  Score

  7^/10

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral2