Extracted

Extracted

• • Target

    10a3e2673f296e7c92fc0f7df5120390a0d25081c95d919fa8b5d5bbf7e6c4f1

  • Size

    4.8MB

  • MD5

    0803c89d362fe0febe13bd092ef98ed1

  • SHA1

    036ec692eaffb018e360fd201000cfb4d9c89790

  • SHA256

    10a3e2673f296e7c92fc0f7df5120390a0d25081c95d919fa8b5d5bbf7e6c4f1

  • SHA512

    6d3cb36af5d2494ae288ed430c742372ef12ad7042b3cd7dacfe8ba839d9c342148d94129f5a3a5a1c59fbfb083cec413f9f68fb245b9d50e85d0769a87b1919

  • SSDEEP

    98304:yM8J+8omYJANECGB4s1ttmyUyASGifO7B1cbgarT7rxEXG8B5X/:gJvYmHe4s1ayUSNfOXGHnqGe1/

  Score

  10^/10

  amadeysectopratsystembcpersistenceratspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1