Extracted

Extracted

Extracted

Extracted

• • Target

    2023-08-13-07.zip

  • Size

    67.8MB

  • MD5

    82880c280bd2f28133e9bf5104fe0b28

  • SHA1

    4a2194c2c296b60cc2de475edebe4fdcb4642539

  • SHA256

    a1f23acb5b4f73ab636d3435dc97347e12c2b4dc8480192335030e804eda672f

  • SHA512

    ef45be0a5670fa27477645256cb2f8b70783cbc8e4ffc70bca3eeb43567163bf99fb0e97ca933f7eee384e1179f24e664c0c5a762fd62b44fa81ca07243b5b5c

  • SSDEEP

    1572864:r1QaIKvbms2K43amdKQi8rATB362DZ1HKnIqr:jIKvbms2K43amchUAVK2d9KnP

  Score

  10^/10

  amadeydarkcloudfabookiehealerredlinegibondropperevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Detect Fabookie payload

  • Detects Healer an antivirus disabler dropper

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1