Extracted

Extracted

Extracted

Extracted

• • Target

    5467d6221aff7ca954960fb5407b326465cbd8196fbfd3bfab19708f9985e802

  • Size

    1.8MB

  • MD5

    51f47917bef7d86ec643b9c7de7926ee

  • SHA1

    e6ead804460014425731379284425b8bfce2fa7e

  • SHA256

    5467d6221aff7ca954960fb5407b326465cbd8196fbfd3bfab19708f9985e802

  • SHA512

    090f480484717eb9b2e0acdd77d304102b36bfd9d355e56a5daf8194271b7008eec022bec1b193f929bdfb12897ff61142347ccbb3d99fc8edc0fb4b9dc91e32

  • SSDEEP

    49152:AgLLy0YhW9wtktZC0lOmcLqwsBDvAVrTY:AgKFhW9woC0lt1biI

  Score

  10^/10

  amadeymonsterredlinerisepro0e6740e76b71newbildevasioninfostealerpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Monster Stealer.

  • Monster

    Monster is a Golang stealer that was discovered in 2024.

    stealermonster

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables packed with Babel

  • Detects executables referencing many IR and analysis tools

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2