Extracted

Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 0aae3c635faa512b497fd34dce58b7b5fcaafcbe0a67e4c154cf7659ba334b81
  • MD5 3cd5cfd593b9708f8a72fdea8bbcaec5
  • SHA1 d6973c358e3997dbaf694f0db6693635bd780664
  • SHA512 15eea48efd945fec7720649b0287848c3afc087bf9ce4b505819298102e3384961643ff3fae005bd5c4a22cccd735196d0a2220e2f609d7bda5b57c59f69e8c8
  • SSDEEP 192:xcolWai9BQ5tMxeuwq5C2PFJxTEZmFhEorccGF:OoJi3Ak3PFwZsMF
  • TLSH
    T1A122D61E2E460330EE5048B0E2755A4A553D5DE37386FBDBE333D5970AD5D8584C0AAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2