Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    9f64a26de6766efd56fff621726954bb50816012e8d57f512a5acfbf015cc433
  • Size 1.8MB
  • SHA256 9f64a26de6766efd56fff621726954bb50816012e8d57f512a5acfbf015cc433
  • MD5 2d35ffff9a6d3a17eb3f27091669ded5
  • SHA1 9aee343d728b7d8958bbbc66cfc65d24cdf5e040
  • SHA512 79af3e7ad577ad4a4d59cdc733ff1c22180ca258a17cc8a85886c81adb99fad5c815842acd8281776f04a1ec410b566392d62dd7d8cddaf011daa766181032cb
  • SSDEEP 49152:0W5k8qE6volfYvHvsKaslnyd1T0kQvbGKEXWwfqe:lsXnPkyny/TxQ3Ex
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredline8fc809e76b71newbildbootkitevasionexecutioninfostealerpersistencetrojanvmprotect

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables (downlaoders) containing URLs to raw contents of a paste

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables packed with VMProtect.

  • Detects executables referencing many IR and analysis tools

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2