Extracted

Extracted

• • Target
    _7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
  • Size 10KB
  • SHA256 7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13
  • MD5 ea425b8c0e70dca5e395592a4e7379d5
  • SHA1 4a65b44aee410e901fd318ec7043b653b1215e38
  • SHA512 a14185301d1c7daa0aa1a3b48c20fbc6e95664fd37abe4735458520523633dbdbd143f5b135af4cd722802544a009c893633301685e6ebefb63fd7c2091559f2
  • SSDEEP 192:YK5oJEWkKB6x+eWlgzPFJxTEZmFhSorcw32:J5oJMZwdyzPFwZK
  • TLSH
    T13D22182F7E850231E3A049B41176964F553D4673A787B3EBF373D5990BA92488440FAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanwormadwareransomware

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2