Extracted

• • Target
    Crypto Flasher By Eexclo.exe
  • Size 39KB
  • SHA256 e7f1a971d79bf517aefb1023c61aaed32072bae3c9c477782fea20ef55f3e216
  • MD5 6a6886b5588f9170b905e48d6873a270
  • SHA1 df3b06be59ed3e6af8cd35f27f9a21b959421cdb
  • SHA512 5d5b9e295725a37b09a713333e607704d96a146dd09ea6efc34c3a175ee9671d44d4f7b3ed8c9bf0771f2d7fd7a401b372df1fd8f8acfb2e33092f842d4c48be
  • SSDEEP 768:+NIikyGe4EJYAAbFsukvZpk2AmzJCUPjied/0Dj9LSueC/9EceHF7Q:A9GepEkAQNiG/0nQurl05
  • TLSH
    T16F037B6E03E501FCED4641F6C872A527D370F1572DF1428E8272D9DAEF43B92A928B45
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xtinyloaderloaderpersistencestealer

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    Magick.NET-Q16-AnyCPU.dll
  • Size 824KB
  • SHA256 24f1503f67939e6be08107d4effcc6d83f6c6155eebdb6526f75555b86feca53
  • MD5 f1b1bbb97906338317c47a325c973af7
  • SHA1 e770750a62e0971f5514b4eee9f58df14bd842b4
  • SHA512 7cea6f51eaa75f5b4e567d8338d6a4b69c466c0249fc66db2bf39fe0563978482c738022fd2e31ec0ea50891e9b1b10f80cd4bc19c7f1beae9a8fd3c0c47852c
  • SSDEEP 12288:ZLL9OgRo18225Rhghqu2UnMyXQNGmf9S2c0:Z39E182wWqu2UnMygNhf9SC
  • TLSH
    T1DE054B5413FC5827C82E0235B47646A1EFF1E6876317BB6B72DEA7A42F123460D462F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Magick.NET.Core.dll
  • Size 1.5MB
  • SHA256 0be900b8d8dc3e1d208aab286e8b0371b87e5ae01cee6e936aeb5eee71099bc7
  • MD5 097edf28ae2bfac5a06cfa73507082e0
  • SHA1 9dffe50e5147d418adc83dc04a3d933d7837227c
  • SHA512 5ce8023b34ff5f0a9e61ee3bffefc01dfc4506fc056a50a371244ca8a454a913172db8d628a23a8fb2b3460e0c3984ae752d26cf8951dfe2725a82892ac0211c
  • SSDEEP 24576:5eRxnIyeazknKKKKKKn/1SD2OuaACajAyCE7ykral6CK7g:5eRxnBzw1i2yAC+AjENraICK7g
  • TLSH
    T1E965F105E7EDE596CE86A376B8E1CD3E45BADF02540193437AE83DAE35B3B00DD82251
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    Magick.NET.SystemDrawing.dll
  • Size 34KB
  • SHA256 a1b2532d8fa5e63ffd4097110520ed3f842bc5c4d37474785e456fd794568436
  • MD5 13f0b8c837d4dbd998175d5b911e0f8f
  • SHA1 2f615bd66a8b37e01a8bec1bdd72aae623a0df39
  • SHA512 765e5094babdec9ef35fd6b527a4452a34aff33b22f2783c5f3a8389cdf8e5dcd3d59d4cb42506cc526611c39771de05488d6ff6f412ee8f07167d3629298680
  • SSDEEP 768:q1mHrslGw1WFR1F/sd47Y+iOJh2Ip4mKqxf1mlhCU/E7+4y:q16P/R89sfIr/E7jy
  • TLSH
    T1EDF28D9D876C8203ED779F70A2F0EA43EA38D7A39DB2D75B18C982894C477C46751329
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    MahApps.Metro.IconPacks.BootstrapIcons.dll
  • Size 2.1MB
  • SHA256 321491f67a9a5bb4025dd86cb750b8a3604e6944504b8ac76c308ad75630e07b
  • MD5 33c3997412acd0a1b013224f3f254cf4
  • SHA1 eae27570cedd91d0dc462f1c78a6010829f49b62
  • SHA512 49eaf61cda881091f1ab4e281c56680493bc42e6709fe94f1dd8a880d6aeb9003563c4066b58b0b2caa61d64f18304132d959788d60861a72e5acf0217220013
  • SSDEEP 6144:k7uRLk9sKKy7RQNsMse5AV54EFdxtkYVBQoahtxDfzjADAW4vBM9jd2e+pT9IaRr:BLGG
  • TLSH
    T1BAA59D3C2CA2A3A36379C14996D80907F45616B7F1321F4B72C74B99630AA833AD5FDD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    MahApps.Metro.IconPacks.BoxIcons.dll
  • Size 2.0MB
  • SHA256 19f998341bd3efd02d6e8160dbeb9af490fcf08fd1b5fa42f8364eccf88f5e3d
  • MD5 bbfd77817762ae719b5d59e263cb791a
  • SHA1 af8ea52558e6345f1f801f278b7707182d9bb9dc
  • SHA512 e081528db96b451a58ce89711327c99738a9be02e0939d54751bb2746bd32a7408793517e213d8fa20ce510c2ea586e7cf767e5fd8f869a34c1b10c6e437f40a
  • SSDEEP 12288:3DbSHSkOZo/IMCPY3sgUVhv9Rhz4iamcXw9320uVBizAwxWjYyF:
  • TLSH
    T1E8A58B3D5C1643372676D21AE4C8994FF85019CBF6311F8A60CF4B9A6927A0378C9F9E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    MahApps.Metro.IconPacks.Codicons.dll
  • Size 560KB
  • SHA256 81b78a808d20142c5165d907bb335cafc65db6ca610b69c8369a1b1672528129
  • MD5 9460e0caf8cb0cb12dc35246fd94f06c
  • SHA1 cbf829519416bf1012a2d74060af53ccde46d85a
  • SHA512 c39f9b5949cace344166c84dd3831b4b2023f36f7a87eb2a788a0929519c141be51d394814fd521b2fde7c2c0937e7451a90873f3e60804d1e80a7a6d37153df
  • SSDEEP 6144:2QmYnKgBzqqrTzWBzqqrUzQ7M1L1MyzLmIJTO:ls
  • TLSH
    T155C40F3C2C96A7637276C11A95C80907F1A641B7F1321F4B31C75B9AA20AA473ED9FDC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral13behavioral14
• • Target
    nbloader.dll
  • Size 17KB
  • SHA256 964feba1e014ce4db752b8b9658fc4acd1bce70598769b53e61b74aa4448c7aa
  • MD5 83aedf0f99d8e776aadbd56c71a90450
  • SHA1 3e65d5ab415ecca8d124c67de170831d14e09d6f
  • SHA512 94951fbb99cf5c2eebcdf8d74b74d513032c465848cf26d0737b317881be60001de7a95f6f62e3a2d737bfcc711c4545999bb88931ebf2ed8688ce1ac62e0ad7
  • SSDEEP 384:JG8FtVhuqNX2T4IJypwKNs0m8ZpH3GCJEjBaPWmdN:1Tx0n0miRBE3u
  • TLSH
    T167827E567FF82602CE874E3EB9E759735E70F3626D70C85E287045088DA53A22E2466F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16