Extracted

• • Target

    d35d55bb74a7cf4349e2fa4a92839e2a88f17a1fee9725801d0d97b2bf0d311c

  • Size

    1.6MB

  • MD5

    952d825a264745bb52b6977ba5983568

  • SHA1

    627a0a841c2fe194dd54f9ec6b0c1231d7da135f

  • SHA256

    d35d55bb74a7cf4349e2fa4a92839e2a88f17a1fee9725801d0d97b2bf0d311c

  • SHA512

    461579e1b94049107a738d74433961b865a536c9e2896f708a3b70026ea18712db6bf57c0c62173659ed8f79ffb43beee0549a45858e401c3ee2f2a8a6eae73f

  • SSDEEP

    24576:vZNFBKNlMaSOHEB2eXSbSgAaCOHOpxeRpeJphGf4F3xERjf7sI:vZNKJSR5iAaDaeRpeJpof4F3xERjTsI

  Score

  10^/10

  amadeysectopratpersistenceratspywarestealerthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1