General
- Target BLAZE FREE INTERNAL Cracked.exe
- Size 26.2MB
- Sample260705-p74mqags3k
- SHA256 12b90ddb368ab4ffcc98171a59b8a19a07aeb6017b3ec08a06b3b1eecdd9fdd4
Score
10/10
Malware Config
Targets
-
- Target BLAZE FREE INTERNAL Cracked.exe
- Size 26.2MB
- SHA256 12b90ddb368ab4ffcc98171a59b8a19a07aeb6017b3ec08a06b3b1eecdd9fdd4
Score10/10Detect SalatStealer payload
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates new service(s)
Executes dropped EXE
Stops running service(s)
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.