Extracted

Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 c8c58693fa23022dea36954ec1a414726cf48425c12e9e2bf1b19353ced8115d
  • MD5 62e68e55a5050609851970bfb8c16191
  • SHA1 aeaf7ca7b4cf27a352ce5e5349395425059c6423
  • SHA512 b860583ca381fa167e08c2b022d7ea9ebb2f1f067be92a83052061f161fca8009ade736ab3e30be552ec3762ca6bafa3c0a075edf1faac763123cae3bf87bfa1
  • SSDEEP 192:52oPWyeqBMqdx+eqlfisUPFJxTEZmFhS2cf:52o4OwZFJUPFwZf
  • TLSH
    T10A22182AAE854231E7F009B45674478FA13D46736387F3EBF733E5590AA61498440BAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneedle_stealerphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Detects NeedleStealer payload

  • Family: NeedleStealer

    NeedleStealer is a modular stealer written in Golang.

    stealerneedle_stealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2