Extracted

Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 bfd7b0764cac3148805c3d8d13e8a07b2f3e030a40f52c5796c8cb3c0548750b
  • MD5 57110faf7b60dde206d2d6a6fbf6ebce
  • SHA1 8b490ccf90ae7b737177cf537a8a47eb27c8e964
  • SHA512 8b7e276d1f50e0ae4988e15a21474c8a1d640db85cc3d6357a029d8c56bc609426788cd5022fb1ade6ac542d5bcbd5642f9aa3258dc61d7c67c51e8ee570db12
  • SSDEEP 192:uecolWLwz8KBatdx+e5CPFJxTEZmFhSorccGFGp:u5oB85wxPFwZKMFG
  • TLSH
    T114223B2A6E890231E3A048B456758B8F553C56737387B3EBF3339A490FE5145D440AEF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2