Extracted

Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 0d477ed687d9f7424d2d28b66717bad4c0d21db8433752c9c51b032d04066af1
  • MD5 d22dc224cc7f11bf35137ed753078d62
  • SHA1 5a299e5bcf4b947e9e3aee9925ed068dd8809f9f
  • SHA512 9b5be31d5dcbe2eeb44426712634db3c08ed3eb71f6b722a7b952381b6c77c341324c4e12a0897bef3646258bdab9568b822fc17e8c817ed16389c8fadf101d9
  • SSDEEP 192:uaWso+WuaB6x+eClaWBfPFJxTEZmFhSorcP2:jWsoMJwhRBPFwZK
  • TLSH
    T15922392B7E444231E3A109B41175868F557D1233A787B3EBF373EA9E0BE62049440EAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2