Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.exe
  • Size 23.0MB
  • SHA256 f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a
  • MD5 a146e70063384b75dd147acd2de9d1b4
  • SHA1 e87388775d0b1a86e8b2eb5356957371813d194a
  • SHA512 09b322d4e41e57d702278300b9b201704077b48072f67e7f485e1436204d26fc6d01f80348eec7f480efdcea56b6c89d4e3bc60c85c68a08c0a76bb94b2986e3
  • SSDEEP 393216:8Uomo1wPsZg2KezxK4sHsMRqubYtwVwW8cuCq6mdUSCRLwq/y14RwOcDAO:wmo1FLXqrRtbKW8JCq9qJFV/E4RwOc
  • TLSH
    T171372359A3A405F8E4BB9639C9618926D3B2BC115B60D7CF07E079572F333D0AE39722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  01x02x2026ddwwnnlldiscoverydownloaderexecutionredlinestealcsvcstealerxtinyloaderinfostealerloaderpersistencepyinstallerstealer

  • Detects Stealc stealer Version 2

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2