Overview

overview

10

Static

static

10

AgentXboot...v1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AgentXbootstrapperv1.exe

  • Size

    109.6MB

  • Sample

    241230-z54vtasjfs

  • MD5

    44d3b50d1ccd81a308d12164389f6c45

  • SHA1

    2804d27494526b4cc65d3e81d8ff513bada16a1f

  • SHA256

    5d10419375f1f72fa943019eb0c0c8111a84d7b9527245b4062497b16b763670

  • SHA512

    31546f6de9a912c8a7116a82b3667f00e2e8e491edf16722bf6e99ae3152f325c2017fb489e63595aadb270407b6614ad5e5ba6c97ee35ded715625211dddc05

  • SSDEEP

    3145728:y/vlJEFe7LUjkQcrXxqEB2Qik4zH32DH7/6kfrJSm49c1YeKWTL5Lf678h:CtiHjkQ8ME/ikoH3Wbvw9cmno1T3

Score
10/10
redtigerpyinstallerstealer

Malware Config

Targets

    • Target

      AgentXbootstrapperv1.exe

    • Size

      109.6MB

    • MD5

      44d3b50d1ccd81a308d12164389f6c45

    • SHA1

      2804d27494526b4cc65d3e81d8ff513bada16a1f

    • SHA256

      5d10419375f1f72fa943019eb0c0c8111a84d7b9527245b4062497b16b763670

    • SHA512

      31546f6de9a912c8a7116a82b3667f00e2e8e491edf16722bf6e99ae3152f325c2017fb489e63595aadb270407b6614ad5e5ba6c97ee35ded715625211dddc05

    • SSDEEP

      3145728:y/vlJEFe7LUjkQcrXxqEB2Qik4zH32DH7/6kfrJSm49c1YeKWTL5Lf678h:CtiHjkQ8ME/ikoH3Wbvw9cmno1T3

    Score
    10/10
    redtigerpyinstallerstealer

    • Detects RedTiger Stealer

      stealer

    • Redtiger family

      redtiger

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks