Extracted

Extracted

Extracted

Extracted

• • Target

    VoicemodSetup_2.48.0.0.exe

  • Size

    112.2MB

  • MD5

    91b98d97343351e879ef8304798864c0

  • SHA1

    fba2e0c8229165d7f0cc34930ea96a2430d30ee6

  • SHA256

    3671fd712335ef0d15e4d553edf19116f56d2ca18ede39d9d43536ce9e0bf2f4

  • SHA512

    2a9a855d6a955c4bce3f4c23644cdb5d4454cb6e38b83ed5a42c9cf058e48584b762586415014a919d5567544ce570d99771a2258ef20c230a230bfc46c13fa8

  • SSDEEP

    3145728:tYegNHiVdYZxPKyZ+DXfCJSQYBvvisu9koMvqSs:3gliV4z+bEzoviOv+

  Score

  10^/10

  amadeyicedidriseprostealc4165079571bankerevasionloaderpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Creates new service(s)

    persistence

  • Stops running service(s)

    evasion

  • Downloads MZ/PE file

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Windows Firewall

    evasion
  behavioral1behavioral2