Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Hotmail-Checker.exe
  • Size 10.5MB
  • SHA256 15820b27a4965a20accf0f00073977c98dc846878cfb2658cd59dc59b6b42faa
  • MD5 61385798c050fab83d131f3d70f0a437
  • SHA1 2b8a4cbac0dddd1bb2888033a6cf4aabcd130f03
  • SHA512 792038ebe4f08e9e8ec3fa8ac3c5c2f59181628732412e8d304a932ddfbafa7b9081baf8c9dedd5de2346c6972c1c4813ea693fee3c69234159d48a5a98c73a6
  • SSDEEP 196608:zaMoM5tbW897GXPHMe81SF2RPUewq97BtKZ2sHsMRqubRgFtDUZAzf:GMB51wPsZg2KezxK4sHsMRqubYtwZAz
  • TLSH
    T166B6235AA3A505F9D47B8239C9628562D7B1BC224760DBCF07E04E673F273D06E39B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cikgoddwwnnlldiscoveryexecutionredlinestealcxtinyloaderinfostealerloaderpersistencepyinstallerstealer

  • Detects Stealc stealer Version 2

  • Detects Stealc stealer Version 3

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2