Extracted

Extracted

• • Target

    28e6b17dbc94ab578deb129913c5d938f1b4ef81ba9484009efa13be60c957a5.exe

  • Size

    5.3MB

  • MD5

    3e34a4079a28dd2da3595cda4b02b28f

  • SHA1

    b0b3df4afb3d9714a551f9f1db8877e3bb248770

  • SHA256

    28e6b17dbc94ab578deb129913c5d938f1b4ef81ba9484009efa13be60c957a5

  • SHA512

    9e1b0bf3f00dec6774adb49f0126302c0e7726d3f38c044e4bc12505922cc4bb93e55d5a926a4309cd0f407b8c1314cc0f1670eeb1eb4b67c9fa2e1ae03d8df9

  • SSDEEP

    49152:U7nubEiNrMdIyfN6RCZjKDvsbl6TT3kc40e4VOmCOVMhDkrda1oS3QZX+yav3Qwf:U3EJZalfT3x0byWYwE

  Score

  10^/10

  amadeygluptebavidar5a1fadccb27cfce506dba962fc85426ddiscoverydropperevasionloaderpersistencespywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2