Extracted

Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 ca9c127d65c5e9839cf02053e8dffb3869f086bd606badbfbf866e348db12612
  • MD5 0d8c0025ba0d1ee7a92fdf94be9e6476
  • SHA1 c3f7d5b3b26dd52d238c215f561736e0e3c89c54
  • SHA512 d4d0db1337282b1aba04e4b39f6ba17f7ea1ae7b19465f4e0f2c0f35eeae08e20c2e4f6ad9d76b6e75a4c9716091e66acad31cc2adefaef8a344079e74fa2fc7
  • SSDEEP 192:yoTW/S5BQWxSHO865hyPFJxTEZmFhquc:yoCWsufjyPFwZ
  • TLSH
    T15E32901E2E4B0332DE5049B4E471424A552C1EE37347EBEBE633D6DB4AD6E4484C1AAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2