Extracted

Extracted

Extracted

• • Target
    zx.pyc
  • Size 3KB
  • SHA256 74522a7e9b56d662bb5dcf5ec2e7ff9fc3c066a962bd83a85842d44c14a823fe
  • MD5 0694514ef450183a28be77c34ff44599
  • SHA1 291ea9e2c9cb9d1a2179d73903971e972eb7b38c
  • SHA512 2c54b54d9490b8420823725887fc04828f7d9981f95deb017a1c3f86c097014264658ce1c4c269cd40e93771b913d320612f81575ff34b78a4834fdd002f7dac
  • TLSH
    T1D071F99681A189A7CEECE23466C3D0649376C5C07262534FB1259DAD9C8834EE0E520B
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    file.exe
  • Size 10.2MB
  • SHA256 e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93
  • MD5 df3f1cef58cd2e87df0bb3ed78fd2783
  • SHA1 c5b8be4bb80e59c463e1894a84adf31f043b2e73
  • SHA512 70edb3b8bc0ab30833a0885e784f44756b4570caeefd2fea01b869371a9f3f68dbdc5a9c06dff4c4754dbbc99174a61b0b32aac4d1e60335d4018677ee4d9edf
  • SSDEEP 196608:PjE3uvGNFR4x2KO/CoAf8wDCgSGq1eYDh7vkanq7i09DRo:lRi/C7fHCf/eSRv6D
  • TLSH
    T112B633CCBB5D32F4D4E94A3A8C34228C5238F9721AA08B2706EC5B3D7E56B755C2F552
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adware11x06x2026282234discoveryexecutionamadeystealcxtinyloaderloaderpersistencepyinstallerspywarestealertrojan

  • Detects Stealc stealer Version 3

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4