Extracted

• • Target
    OurNew.exe
  • Size 6.5MB
  • SHA256 b139ad03c7f1b95d303b00fb0264897e551f5350fba7fe84a8a75569cbb3d33c
  • MD5 cccd8b8af6771679a26f9b526469e4e2
  • SHA1 311a8ef09cf57b6f613d3449b63d16b852a82814
  • SHA512 adc824f0e2f3b2d2528098798048dc99eb28256f2b333d8e401b455090386a15140c801b1ef6374841c6ca0f792ddcb8d061d90399b715a80644684f6bfa0a9b
  • SSDEEP 98304:qgBHGXnz60gBVKM6WIWKX1oWXXJxd6lr1DDoUm2yxpnbxe:/H4zAKkIz15xd6lr1DIrvE
  • TLSH
    T11C66BD65586FC26EF0BBCBF9FDC53B42C62454375808CAD0D99A81A25AC3BD7E580D0E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  saifdefense_evasiondiscoveryexecutionstealcxmrigminerpersistencespywarestealerupx

  • Detects Stealc stealer Version 3

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2