Extracted

Extracted

• • Target

    advanced_systemcare_pro_v17.6.0.322___fix.exe

  • Size

    923.3MB

  • MD5

    56350b49279ccf7a67d8149a9c25ab4b

  • SHA1

    77a78bbf68ab7564b5f0aecafb84173363f3f22e

  • SHA256

    18bcbd5161a3311538446b0497ccfa40fde691e1afdbdbb083a156288ea5f666

  • SHA512

    775425c7607e9aa99b5c1ab0a914b602c0d038639b484c1eb263fb5da07ab7103a867370782d6200c10a8f1f5fca145eb518851f081eb2b6e8664d9a76d06b92

  • SSDEEP

    786432:aK8eGdUugDCFZUiX8Uk3Ll7pkyAdXroyghObNrG:aKydJgGFaiX8UyLZpkyAdXrpLbE

  Score

  10^/10

  cryptbotstealcxmrigravecredential_accessdiscoveryevasionexecutionminerpersistencespywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3