Extracted

Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 642ece59ea6f9a2f8c4ddf7bc5ee2c758ec9809b9b2f27a6085434e2b5eba870
  • MD5 358798482fd0ad0b5212f29e675b4522
  • SHA1 9a261c7e5f43faa62065ab3d602a972ee680ab76
  • SHA512 2d565b3b16f057900126a7cf2a7e2edda2566e64bf53dc4787ee9ddad2139be4d3d5afa80b347ed25b27962200f78084740ba68e516ae2fc3995b3175f1322ba
  • SSDEEP 192:BcolWLwziNBQ5tsxeugRPFJxTEZmFhEorccGFGp:+oBiHAvPFwZsMFG
  • TLSH
    T1EE22D51E2E860331EE6008B0E675864A113D5EE37386FBEBE733D6870AD5D4584C06AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2