Overview

overview

10

Static

static

10

2026-10-14..._n.exe

windows10-2004-x64

10

2026-10-14..._n.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-14_c1980e97ba9811db172f49182a39872f_amadey_cobalt-strike_elex_icedid_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_vidar
  • Size 2.1MB
  • Sample261014-p1v21ads9w
  • SHA256 b1f0c1d8b1ad3ee9e2144bac4dda12f61b73c9dff16d2d4fa061ce626e1e4851
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
stealcxtinyloaderdiscoveryexecutionloaderpersistencestealer

Malware Config

Extracted

Family

  • xtinyloader

C2

  • http://196.251.107.104/geter/index.php

Targets

    • Target
      2026-10-14_c1980e97ba9811db172f49182a39872f_amadey_cobalt-strike_elex_icedid_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stealc_vidar
    • Size 2.1MB
    • SHA256 b1f0c1d8b1ad3ee9e2144bac4dda12f61b73c9dff16d2d4fa061ce626e1e4851
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionstealcpersistencestealerxtinyloaderloader

    • Detects Stealc stealer Version 3

    • Family: Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Family: XTinyLoader

      XTinyLoader is a modular loader and stealer.

      loaderstealerxtinyloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks