Extracted

Extracted

Extracted

• • Target
    396f1cb4da29ede25ae6a96ae09db11e093c207fdbb3dd43b5b5fa1bf2828312.exe
  • Size 19.3MB
  • SHA256 396f1cb4da29ede25ae6a96ae09db11e093c207fdbb3dd43b5b5fa1bf2828312
  • MD5 22366201c21c3405814973f1e0232e5e
  • SHA1 66e5955e44e3133fbc3646ef6b3735e6c10f1e96
  • SHA512 a7ddc7aa9520b620b718e5ebebeefd4acbe603b24f298ec062c57995b21cfcdd40fb316d8fe0fb50ca8fe7e92dc6c5af479ede708394fe84971889b6da76b0cf
  • SSDEEP 393216:0JiQipGmen1yNdq1B7iR0gpHskqSPjZpiqbH4a7po:6iCn1yNg1ABoS7Zp9bH4
  • TLSH
    T16F17F012B9A916A5D5FAE1388469E231B6713C5503317BC70BD82ABB3E37AD45E3F304
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  buildzzfffdiscoveryredlinestealcxtinyloaderinfostealerloaderpersistencepyinstallerspywarestealer

  • Detects Stealc stealer Version 2

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2