Extracted

Extracted

Extracted

• • Target
    06f42fa9e9d8f0c01a7c560490ea71e4cc582069527a5336cdfc299ed1e67c32.exe
  • Size 35.5MB
  • SHA256 06f42fa9e9d8f0c01a7c560490ea71e4cc582069527a5336cdfc299ed1e67c32
  • MD5 737edcee199dee2c2004b06015039ef5
  • SHA1 b316dbbd9742b7c6f1ff536984fda926948e75da
  • SHA512 bbf60087c7b73622babf8cb44d64faf9ad61dcbd2a77dbc365e8206bc104bb8dd5e3cbff61bdadfba777a263c645da54888be6c15fefab99aad527301b0cd987
  • SSDEEP 786432:Ti51FLXqrRtb/S/N1ILX3JtUpTbLYH4Baj3SWL:251NqrvbY1u3HUxbQ3R
  • TLSH
    T1C4871212B9AD16B9C5FAE2388469A211B67238650331BBC71BE8157B1F376D46F3F304
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  droppedfffdiscoveryredlinestealcxtinyloaderinfostealerinstallerloaderpersistencepyinstallerstealerdefense_evasionprivilege_escalationupx

  • Detects Stealc stealer Version 2

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2