Extracted

Extracted

Extracted

• • Target

    094abd04a4a443a8ba8ad028cd1891aa62c1bb509afef99e5914286a246ebaa7

  • Size

    1.8MB

  • MD5

    204b820ac458bb5929040fcfdf6840c3

  • SHA1

    00f16b786040abb7f04eb6b6bcaee9efa52dc5f1

  • SHA256

    094abd04a4a443a8ba8ad028cd1891aa62c1bb509afef99e5914286a246ebaa7

  • SHA512

    466138efc927c60d2cf0495d40a6be24c17f08867d75fa38f46568d0e11604db7865fb51274bc615ed67b03d056fd5ab323a0a29bef947ccc2edd9da12df3ca9

  • SSDEEP

    49152:jlWjcCb3NgplmMn73GquxXK3wP4Ii5UNdKv5E2f:jlWoCbEAMnKtx6UVgW

  Score

  10^/10

  amadeyrisepro0e6740evasionstealertrojan49e482persistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2