Extracted

Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 99dee89a3427e03b136a462f486cf3537f98f4fc82c16dd9119080edf3eb4d2c
  • MD5 26799ecfcf4fe9850a1c224aa39c96be
  • SHA1 940844c040b79a2a3b85f5762d5f39ac593ba1d7
  • SHA512 70cfca5488f274bf682301627a53884c3f3671d43470b63267b8c2dd005924a34ff339be8698be62e9baa66f19b13492740cac28cf648651b81bb73e06ce70b1
  • SSDEEP 192:qWZojW0EaBlx+eGlLUN9PFJxTEZmFhSuc:7ZoxEOwt6fPFwZ
  • TLSH
    T111323A2A7E590232E3A049B45175874F553C1533A3D7F3EBF373A65A4BA62888400EAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2