Extracted

• • Target

    96b675ea1180623cbaaab1a0fa5028320bf161fa829bfa922a4b920160b47def

  • Size

    4.1MB

  • MD5

    57b08e037d5b265b459aefdf565d817a

  • SHA1

    525b42a7c5a736c45810bdeab451301673c775b8

  • SHA256

    96b675ea1180623cbaaab1a0fa5028320bf161fa829bfa922a4b920160b47def

  • SHA512

    77ff717f277ec544b88760ff08dd19134669b7c0b109d141daf3695686402ef57db4d38fddaf64945adc72da05af55dd9f427590eca5f4c96bddc3ffa28a3422

  • SSDEEP

    98304:Xvb+8kiY/43mw/pKVw6GL2MDo17yxfdo6Co5auE/INc:Xm3w312GSMDo1yH

  Score

  10^/10

  amadeydcratsmokeloaderbackdoorcollectiondiscoveryinfostealerratspywarestealertrojanvmprotect

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detects Smokeloader packer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1