Extracted

Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 158380ebd870255fbf0ecc986480b6ec4601a5074db9bb2ff41cdb626dbee2be
  • MD5 25a24d759937813e28d65d08f342c3d3
  • SHA1 965a6e624f0a24d09223fd0a3c41e0a7d92844c0
  • SHA512 f1cd486ed97dfee5c3c2a20057c31e745ac9d06a437adaab30e91a550e84f9098fe9a5b01b4d02384b4fa5b9ce9f5b8f235589e34d9b9e24ec29fd3c42538b8d
  • SSDEEP 192:QIo2WBS5BQcxSHO8+59DtPFJxTEZmFhquc:ro/csuDfDtPFwZ
  • TLSH
    T1F932B31E2E4B0321DE5009B4E575424A517D2EE37387EBDBE633D6CB4AD6E4580C0AAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2