Extracted

Extracted

• • Target
    _f55acb3e7fde7e6f9800bc6b705cc4067a552bf480ba9c730d1f325d8ef1a15a.exe
  • Size 10KB
  • SHA256 f55acb3e7fde7e6f9800bc6b705cc4067a552bf480ba9c730d1f325d8ef1a15a
  • MD5 08e9531670974fdfa5a92dfc61fb70dd
  • SHA1 c5e8e846df06c92f52e3c1ce1df3812d3efcde83
  • SHA512 5b129b73757178dc31ab819ea0e4c680c706466aa8e9ead6475e617ec444f82ca37ea228ab55605d8b544673e21f2deca0394f085c84c3b263f2d2b06e885dc8
  • SSDEEP 96:k/dfsoGYz/9PYz/qYhwGgB3dSpqDrVx+ZQxrdcNGiPFJxGE9mZ2FFhxC7tCEmcfR:kqo1W4JBxx+exSLPFJxTEZmFhSmcUsh
  • TLSH
    T12B22381F6E490131E7A18AF016B64B5E917D5673278BB3EBF333D5880BE95848011BAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2