Extracted

Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
  • Size 1.8MB
  • SHA256 da730557f8b4c1520f0de35abbe7680031db2dbd9ccc66560d58b3c4e2e29828
  • MD5 5ffa91652bd79f6a0938a7f01cf25a82
  • SHA1 bbd3e005d253320876ed820b75ea9293596e4544
  • SHA512 963ac8312daacf9f9ce825540a744745fcd2583a9b500a28ea9342636709cc0a67906db80af07fafef62d45151ce15ec95b32cc8a07789ad3ab8b568f8fd8997
  • SSDEEP 49152:RGATe4wEwYMW/37z+mFJJU7FG1dJCZzwTkN:A2e4wyfrCTIdazOm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyevasiontrojanredlineriseprozgrat@pixelscloudinfostealerpersistenceratspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2