Extracted

Extracted

• • Target

    92b1d3003f2bdef59d186e119ab89bb38fff0d1eff554172618bef186dae17e1

  • Size

    1.8MB

  • MD5

    f0b66b6dbd4b08e9c5daf536f73dba5e

  • SHA1

    800212cd4edf77c4e3b4fdafd18afd8ea74be90a

  • SHA256

    92b1d3003f2bdef59d186e119ab89bb38fff0d1eff554172618bef186dae17e1

  • SHA512

    b79f9e1f7f279a2e162405644eca2f67150d789705ff744f49e9dac15abf643428002a85ae0d0c3fc88c13d7088ab4cf8368d623296245340cdaedae497399a0

  • SSDEEP

    49152:b70vk2sNH339Il99Gk7l7Nbbeomh38GaO6:bFn9k94kx5beos1aO

  Score

  10^/10

  amadeylummadiscoveryevasionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2