Extracted

Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 caccb7aa5c67860ab942576d7466e126eb94c538a91bb4e7d2cdf3eb9992f818
  • MD5 500b3ec4308048b37ce8a66f3614d7c4
  • SHA1 e48b683ab9577ea681bfd76e363993f94ed10ffe
  • SHA512 03635deccdeb7307ffd2f08302d5a9723c97f4e8615f1e610720670f1d18c0881cf132acf4eb3a7c2eef88b67f9da0c0c05bd483cad155c4961d3e56c07ee4f1
  • SSDEEP 192:R0o92WaqBBFQlSHO0UOJu+PFJxTEZmFh3ScP:eobQwu3OJu+PFwZ
  • TLSH
    T14232921DAE4B0331EEA049B4E475424AA46C1EE37357EBEBE333D18B49C5E4488C192F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2