Extracted

• • Target

    virussign.com_20241209_LimitedFree.zip

  • Size

    12.6MB

  • MD5

    6b3d9c02066b33e120cc70909c5806d7

  • SHA1

    0af21bb623041bbe95792d11fe64cc4001757409

  • SHA256

    8455503a13bf1290304f2cc41b0f3bfbfa88ca7d5276d34c9e42514c270117a6

  • SHA512

    84863e117e43246485c51db1dba46f8c014fc9a48bd57861654f0454c80dfa5adf688fdd41f328583d43fad5ef0fba2ac836ade4375a38177b039d7ec81695b6

  • SSDEEP

    393216:n9FMWw1QRAZ8PyF8vhNRzVa/8EfDX9SnziNjcP:tw1KBPyWvLRo/8JWla

  Score

  10^/10

  berbewphorphiexxmrigbackdoordefense_evasiondiscoveryexecutionloaderminerpersistencespywarestealertrojanupxworm

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Berbew family

    berbew

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1