Extracted

Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 6b221814fa8c8d800a2ea3dcbb30943c33d8a28e184dbd368e42c5f5e92f90e4
  • MD5 a53edc758bc697b43b92f366dfb21992
  • SHA1 5160ab7f4d04c8e536eb0b0de6e8ce5496e4e1de
  • SHA512 c3c6638c6b617af74584c051655fe63142b888d5760c8a4ab7ddc177266c8b2d4ccafda9cbd0e7e305751c5c75deadca7febc583f43338970d1e28e145490df1
  • SSDEEP 192:HroTWSqBEx+eylG+Ibi/+I4PFJxTEZmFhSuc:Hroz7wxLIbLI4PFwZ
  • TLSH
    T10B32092A7E490331E3A488F41475438F653D5633A387A3EBF77396AD4BA62448441EBF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2