Extracted

Extracted

Extracted

Extracted

• • Target
    NexiloNitro-Genrator.exe
  • Size 11.1MB
  • SHA256 c83f7d68fa77ba191d01e23878d433e2a894732a20c8aa71e72e82896c7e8da6
  • MD5 7f2be5c20b45ca6837e3ea60392200d0
  • SHA1 0813910f5d43306c7dbe398d2c6da64d02fe193d
  • SHA512 af4a0001873ebd164ab69fe49ac851f7295cac9eadb532b32c7714a894c73f60b467e4fb9aee2c1480cc8adadc3841662a42f0aa164a72a41ada43aa7e92a81b
  • SSDEEP 196608:7vcpYgenXMCHGLLc54i1wN+iV0cSXl74w4Uq44By8lT86ff1nAcdrNPi2:7rJnXMCHWUjqVg74w044B6WNPi
  • TLSH
    T1BCC6220AA79411F5EDB7C33CC962460AE772B8691731A68F03A416EA9F633D05F3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  42095347b27b46c0e9195ed43d5626dfdiscoveryremus_stealerstealcxtinyloaderloaderpersistencepyinstallerspywarestealerrun

  • Detects Remus stealer

  • Detects Stealc stealer Version 2

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2