Extracted

Extracted

• • Target

    b992a18f00c902840fcd2bb93223a8cd58d0da1d9e142a90523931aa3f140276.exe

  • Size

    465KB

  • MD5

    001c8845e2489435657b200199b369f8

  • SHA1

    1891627447cdb5bdcb50e39987084d112923a155

  • SHA256

    b992a18f00c902840fcd2bb93223a8cd58d0da1d9e142a90523931aa3f140276

  • SHA512

    cfe52ed2f55b3129326a93c724fa771f5085e55ac93f9ce9ac2bbff19f4f2c962177698aecc880ffefd07a3cc0b8ae32fc5facf430720ea490a6b3bae41ac30d

  • SSDEEP

    3072:/weqOYEUXPnOFWKdWuP/sB76OFftW+vX9IR3:oEUX7yQJNYEC

  Score

  10^/10

  phorphiexxmrigdiscoveryexecutionloaderminerpersistencespywarestealertrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/pin2taskbar.exe

  • Size

    37KB

  • MD5

    49db22529662a72f546d80c1160c2d13

  • SHA1

    c4deea954054f1ac290382796d24ab6bdfae2bfe

  • SHA256

    b0df9c447047cf0c96a84441b07959e25473c1d7140e0a95b6b2084962b88e62

  • SHA512

    ef53c7f6acdb7c361f9816b63b9c9081960593a73eae3ce93ce025856d99111e05a93b2a06a6016b3ba37fef129c75cea2e70709e45ff980c396099499ba11b6

  • SSDEEP

    768:dHBVYZdTNss7061hOzPQPkkSfED4nN08+3wBNcv:7VSOs70+XkX83lv

  Score

  3^/10

  discovery
  behavioral3behavioral4