Extracted

• • Target
    rw6eMTC.exe
  • Size 5.2MB
  • SHA256 f28ec66ea72ab255e028b98e3103070e0e412030352b9c66aaf696266fed38ca
  • MD5 9c004138bea1f426fa43b6edbae46da0
  • SHA1 a7a56f18c067ce06762c335e471b500551683905
  • SHA512 d47adea1fe88abc847c5eb7b4678f5bdb143a071200f3473b98a7be5bf88bc14f72573d057e45f0b2e1335a437c3f3a526a80e8c0d81146dd16fdda1356fd4cf
  • SSDEEP 98304:+p4g1jNGVAjP3tZytkWWr42NZtQwR+r1gzAvtvPHyb2tbklDL0qnKVOqzCX/O84M:+p4g7sMPKtkWWrXmwMrFXSb0oCHCPO7M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  deerstealerdonutloaderhijackloaderdiscoveryloaderspywarestealer

  • DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Deerstealer family

    deerstealer

  • Detects DeerStealer

    stealer

  • Detects DonutLoader

    loader

  • Detects HijackLoader (aka IDAT Loader)

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2