Extracted

Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 c8415587863d57e1cc4aa543ee9c0cb04ec486f031b49f2d7448631c4a5b29da
  • MD5 92b274e8cc85fe15f8ddf066725bcc69
  • SHA1 4e0d350ebb2ab380db1b1fbf4d5f99a3d4559436
  • SHA512 e70e23eaa245b37bff55a31ee52483741579f51a662ad64c528aef1c2f93c4a67a16db223729fcf44e3acfe67c9fc95237223ad6911688c57e94da5e9fdd59c0
  • SSDEEP 192:FM0o92WPrBxl+W4OX+PFJxTEZmFhvScP:FPoDf0lOX+PFwZ
  • TLSH
    T1E5320729FF4A0331E3A489F45479828BA57D5623A397E3EBF333965E4E552448800E6F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryadwaredefense_evasionneedle_stealerphorphiexloaderpersistenceransomwarespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2