Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    6069a4aea1cda39a5473e5f4d5345208.exe
  • Size 1.2MB
  • SHA256 23941746340e89fb699e4ecec106fbfd40186fc5b483bf72d82d5d5a2706863f
  • MD5 6069a4aea1cda39a5473e5f4d5345208
  • SHA1 f642db8792c968782c83549f9001b3c98df00f8d
  • SHA512 0a4036fa691c9e62fe19928320428edc1f0c2062e05e15c411ef59e797c0f52346ec79d52eb9edeb4c27911ce56840468e9f6ef2a5c44dbc3322185a8766ec5f
  • SSDEEP 24576:QfbGtPFonLxrkJ7iwxErvVHahHOloF4CL8YH8pa2/JvxYw/tqx2C:QfattixrsXW44yF19H8nRvKw12
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyprivateloaderredlinesmokeloadervidar6.6937advdzkeylogsdiller cloud (tg: @logsdillabot)walhallabackdoorinfostealerloadermainspywarestealertrojanvmprotectnymaim1discoveryevasion

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Smokeloader packer

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2