Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    439KB

  • MD5

    db5dea81bb668fa4386d2ea8ecbe9e1c

  • SHA1

    642f1d9423d883854a06f50b03619c16fe33281a

  • SHA256

    abd8284914e8bc1309c13903e7b41b1af552c80598982c9e8fbe35e88eda9315

  • SHA512

    b7a0a78a34d2a1f00385b58fd172e4d0c9224c9d1020fe656a7bc4414dadc4ab24e40ad6736f905208747c8d048da0f4efea1af965c12a218d46305f90721fad

  • SSDEEP

    12288:kehYGKhh2CbBZ0MjA7Yhsd7R6jOP1tcrEQf:ZiGKPZbYBYhsd7dtF

  Score

  10^/10

  amadeysmokeloaderpub5backdoortrojangcleanergluptebalaplasredline070723_rc_11up3clipperdropperevasioninfostealerloaderpersistencestealerthemida

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2