Extracted

Extracted

Extracted

Extracted

• • Target

    1783a69593b72237fce4111d231ab3c919f9220e8baf8b2216c488d4dbedcdf1.exe

  • Size

    231KB

  • MD5

    3dd072d71907f6d5a5b046908c081f11

  • SHA1

    6432c3dacb6e4dec30ad44cc92f79d4a0156affd

  • SHA256

    1783a69593b72237fce4111d231ab3c919f9220e8baf8b2216c488d4dbedcdf1

  • SHA512

    2f6a4df887ad59e8b34644e8832f843f0f3c84171dbd8ceee9e1ec348684ba43a7ab4f2864464e343c8a17bc147839add11c939dfcea4fd60f79f48b89010453

  • SSDEEP

    6144:0s9bFCavQJdMSzPgI0KIikB/NiFEZu7dRmV:pbFCRMcRIiTFgu7dR

  Score

  10^/10

  amadeylgoogloaderrhadamanthyssmokeloaderpub1backdoordownloaderevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2