Extracted

Extracted

Extracted

• • Target
    16.exe
  • Size 195KB
  • SHA256 60c814c50e67dc7f3955480940eefcca439218e841ab28dce2348e5791709ca0
  • MD5 89db7f30b990df6be281ef43c6baeb31
  • SHA1 20144fd3597f80235d1ede9f6e5a84e7cc290c26
  • SHA512 f2e0c593df874678c91cd89e6e079f5f19553b3cef3fcc2db2bdc543f70b0d8983f921e48961cf65a549c4683f7b029ddd5488c2131a4264c4f08f521f8a0d29
  • SSDEEP 3072:3gWb82gcMbPdG2kHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:3gv8wqyrWpAKhhvORHJ
  • TLSH
    T1D7147C4763EA21E9E7739138CAA54A13F770B42213149BEF07E0865A5F233D1AD39F21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryinstallerpersistence06x05x2026amadeyexecutionamadeystealcxtinyloaderloaderpyinstallerspywarestealertrojan

  • Detects Stealc stealer Version 2

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Downloads MZ/PE file

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2