Extracted

Extracted

• • Target
    33166e17fdb736cdfbe304002b081db17069618d5110e30b3a01d9086d5e1273.bin.exe
  • Size 29.8MB
  • SHA256 33166e17fdb736cdfbe304002b081db17069618d5110e30b3a01d9086d5e1273
  • MD5 87c61136236dbb9ab635e379d866fe49
  • SHA1 b918bf19df52464f084f35cc915fa8490e49a7c0
  • SHA512 58b8eb3912f4540272233944cd62b4864ab53163d29dbd9febb97fc6f4ae058473f718c41976b7f4d62ba004d087f2e74a7bf030a7b5852675d16eadec03775c
  • SSDEEP 786432:+4gosA/IsAmRJOw3WSAkc5G0s/pvFH/ZSQ:+4PJOw3WSAk66/pvFHMQ
  • TLSH
    T13567DF6CCB68261A742D7EF0090237E8FB64140277665CDEB8A9C13611AE4FD8E3F765
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  crypt2discoveryexecutionamadeystealcxtinyloaderloaderpersistencestealerthemidatrojanupx

  • Detects Stealc stealer Version 2

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2