Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    tmp

  • Size

    497KB

  • MD5

    f06f0f0288cdc3abca062037eed25964

  • SHA1

    0b13302622c80b36385bedce93b999081ed20d87

  • SHA256

    f991e808ed44c731fea1758fd6a275ec4e3ee66a5a691dbf1f9414a5faa144a1

  • SHA512

    d40993a93ad0a92570a80f96d33d55f8a44157a5a0a8bf83f1044394c5eface950c5be763b331e50dbc121890b70ab2bc72ca29096601d1c2952f242c8c44394

  • SSDEEP

    12288:OnDOS1B4EjNHiBWOB3o5GzxUiuJZHOifD:ODOojNHi0Mo5GzCTJM

  Score

  10^/10

  amadeyfabookiegluptebasmokeloaderpub5up3backdoordropperevasionloaderpersistencerootkitspywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Windows security bypass

    evasiontrojan

  • Modifies boot configuration data using bcdedit

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Manipulates WinMon driver.

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2