Extracted

• • Target

    tmp

  • Size

    1.4MB

  • MD5

    97201c944dcd7e82672458514a67a7b5

  • SHA1

    2bccce2f6a090dd37e7510ac1dc5e1be5526c3d2

  • SHA256

    0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12

  • SHA512

    0a7bd0ad596a2024631792d5c50647c9fc7afa19d67e69417a41f611591d97647f96a5776f05a0a380848d0c027d055437ccff2e037641146a56c8008355e53d

  • SSDEEP

    24576:BdnSOXpaWQoCs7Gzxdnhk6d55xedwiNaE9Jvo6jEsAfdyn1f0IEI0ICERltNGnXj:BdnSOXpaWQoCsaz7B55Mf9Jvo6q

  Score

  10^/10

  pseudomanuscryptloaderamadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects PseudoManuscrypt payload

    loader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    loaderpseudomanuscrypt

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2