Overview

overview

10

Static

static

10

simplechec...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    simplecheckercaloader.exe
  • Size 60.1MB
  • Sample261028-jf47aaaw6t
  • SHA256 26b9dc1dacb0d784f09193385c370be060b65a0bb3e7ce5e129b9b2164703d7c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
redlinestealcsvcstealerxtinyloaderddwwnnlldroppedmrgbooxgp55qkw==discoverydownloaderexecutioninfostealerloaderpersistencepyinstallerstealer

Malware Config

Extracted

Family

  • stealc

Botnet

  • mRgboOxGP55qKw==

Extracted

Family

  • stealc

Botnet

  • Dropped

C2

  • http://45.93.20.55

Attributes
  • url_path

    /49dcd5e318c542c5.php

rc4.traffic_key
rc4.C2

Extracted

Family

  • xtinyloader

C2

  • http://45.93.20.151/geter/index.php

Extracted

Family

  • redline

Botnet

  • ddwwnnll

C2

  • 196.251.107.104:1912

Extracted

Family

  • svcstealer

C2

  • http://45.93.20.55/xuiobvu/data.php

  • http://62.60.226.159/zbuyowgn/data.php

  • http://196.251.107.23/diamo/data.php

  • http://178.16.53.7/diamo/data.php

  • http://158.94.208.102/diamo/data.php

  • http://196.251.107.61/diamo/data.php

Attributes
  • bot_urls

    http://196.251.107.23/bot64.dll

  • build_id

    29/01/2026

  • srv_delay

    1

  • srv_retry

    1

Extracted

Family

  • xtinyloader

C2

  • 45.93.20.151

Wallets

  • TBfVoNhyiBzrWXRi9erWH1d8BdpFNoB7dt

Targets

    • Target
      simplecheckercaloader.exe
    • Size 60.1MB
    • SHA256 26b9dc1dacb0d784f09193385c370be060b65a0bb3e7ce5e129b9b2164703d7c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ddwwnnlldroppeddiscoverydownloaderexecutionredlinestealcsvcstealerxtinyloaderinfostealerloaderpersistencepyinstallerstealer

    • Detects Stealc stealer Version 2

    • Detects Stealc stealer Version 3

    • Family: RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Family: Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Family: SvcStealer, Diamotrix

      SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

      stealerdownloadersvcstealer

    • Family: XTinyLoader

      XTinyLoader is a modular loader and stealer.

      loaderstealerxtinyloader

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks