Extracted

Extracted

Extracted

Extracted

• • Target
    TikTok_Checker_v2.2.exe
  • Size 16.4MB
  • SHA256 0446aa639f5d048a5509a9b66466326f666fdf5a8bdeb150ffd812a9c588a4f4
  • MD5 7087977591a7e6e398df7b20042f7ab7
  • SHA1 47a365bbca193d58b01973f0ef9a049498168a31
  • SHA512 ca5012ec4a584b0b4ecd80fde3cf88c59484aad5a9e93ae392b85f62414070d730e221cb7091108f18c5c92ff2a31972db76bf34e0014421646b432aa113703a
  • SSDEEP 393216:0ynUGawJLb05IL1rb3wq8YULUFINvT82MGZ:xMwyCLh3g8o7z
  • TLSH
    T178070107B587547DE06E83368962D122A6B37C151B32ABDB57E099BCAF336D01E3E305
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adware24x01x2026crypteddefaultloadeddiscoverydownloaderexecutionasyncratredlinestealcsvcstealerinfostealerinstallerpersistenceratspywarestealerupx

  • Async RAT payload

    rat

  • Detects Stealc stealer Version 2

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • RedLine payload

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2