Extracted

Extracted

Extracted

• • Target

    7434b42e11380272961c92e061072e78.exe

  • Size

    7.0MB

  • MD5

    7434b42e11380272961c92e061072e78

  • SHA1

    a2dea715e33a860dc09d09b219db18831e6bb1a5

  • SHA256

    9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40

  • SHA512

    b426ec3a12c39bfdbf6a52a2971a44e471a76ca270c0aa2ed9b9bb8f1ad5f48f80e7a86659375a05782964762bc3a56f0aa3de87ac509b01c0cad421f8f46a49

  • SSDEEP

    196608:xhWCcb/OtOBzdC0yo7R5aZPPrf4e0dNL4IkPZFsSM:xhWtb/OtOm0yo3alDfzUNPGZFM

  Score

  10^/10

  amadeysystembcvidar1760discoverypersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2