Extracted

Extracted

• • Target

    9d21f74a93a7132ff95b20b80f406df945a0e46ad8265374ea945a3d8caafecc

  • Size

    1.0MB

  • MD5

    ff3d320aa35b7a9afaf414b215bd0923

  • SHA1

    2cfcab5fc48413444526bf8b79f53026a8722ce3

  • SHA256

    9d21f74a93a7132ff95b20b80f406df945a0e46ad8265374ea945a3d8caafecc

  • SHA512

    3b95f9bfea444c5b3edf09559aeae67017532cd4d10d04b0adf87ca9d3b7622cda752a8ab5de092a4eef49df59cf62f04c34e86d68f278b6fa542fe225de9ad3

  • SSDEEP

    24576:my1kH/6myDXEOoP9xKACPKsX9vOCmna5t2iuSQG:1S6muXYzCSsX5mAhuS

  Score

  10^/10

  amadeyauroradiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1