Extracted

• • Target
    NVIDIAContainer.exe
  • Size 3.3MB
  • SHA256 d9ceaf3602554cc5b5068e3eae782cf04cfe8d6902c87674e456b0f610f7ed19
  • MD5 28cb25c3a9d0953339d8c6ffa93dd02c
  • SHA1 d25bea55ed8ce6754dd1699c0775e2b911d3de73
  • SHA512 1a07cbb3f16a336c3e458473304a4e24959ec91f074987454f118d607432f9086204d63f00dba86a38c2536781e14317723329b73bcb3a560d5586fed3b2117f
  • SSDEEP 98304:O2ZD4RHaq+GgQjBjwzwiIKFCfX7HK6vRznBOXoqK3T:O294YYgK9wzwiIKu+65IXoqK3
  • TLSH
    T16AF533F28B022FEFD9BE0D7911A41F635B37C58072E4B2190DF992FDB1A92036476685
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxorium_stealerpersistenceprivilege_escalationstealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2