Extracted

• • Target
    0fc8ba6720c308d636cd1f80abce889eea101db3183747eb21ed7d6db0aa1957
  • Size 4.2MB
  • SHA256 0fc8ba6720c308d636cd1f80abce889eea101db3183747eb21ed7d6db0aa1957
  • MD5 6e526cf0702648654a0c32aad5bc02fa
  • SHA1 85feaed58491f83d986619b5c5ab9dbb3121cbb5
  • SHA512 a5dad452d44a2a73a8cbb5541fa3a6d3d1ea9b07aaa251acc03f93282cc7f16cdcd5bd1f25ea4c437327c1a66d1fc343311339eb08f82a05110efe67dbd5f9fa
  • SSDEEP 98304:dBYO8Hts1EcwhVG/nBfwOC5K8J87QWoq1sOQqBY:d4Ns5NwOg87QSBY
  • TLSH
    T151263349638893F5C26227BC8C69224D933A38612F66C7BFDBB183134D6E151CD79E78
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxtinyloaderloaderpersistencestealeradwarespyware

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2