Extracted

Extracted

Extracted

• • Target
    739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f.exe
  • Size 16.2MB
  • SHA256 739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f
  • MD5 3cb297e191cc064a4bca8f37bf2f17bf
  • SHA1 b1f6f9ef0a6709ff783f91dbd2530aca1b4fb21b
  • SHA512 092654a9570d55422985cb3f6de0b8950008758f3c6f7e5afcb5dda6b6bca1a56522964554bc3904d4a1394c57e6b5b2554b87a1c9d6172e8f16ea28cf2dbe76
  • SSDEEP 393216:Y5Wjr1Fdq1B7wgZHsoqEbpibzoTGTqb0wemWMlvhnu:s21Fg1Jnlbpp6Tq4wemW
  • TLSH
    T100071256A78022F8D06AD23999E2C139D7337C5113218A8F4FECFD599F376A04E3A716
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  buildzzfffdiscoveryredlinestealcxtinyloaderinfostealerinstallerloaderpersistencepyinstallerstealerupx

  • Detects Stealc stealer Version 2

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2