Extracted

Extracted

Extracted

• • Target

    0d86bb9bcd008c774a8d76e6fc39bebb6dc087c58d6e6ded215e4a5c7d4fc024

  • Size

    1.8MB

  • MD5

    4820e8d7d4826d424eb6dbd602502d73

  • SHA1

    6bf5b3846f96e5fa830aab04e8a07c0d4d56aa29

  • SHA256

    0d86bb9bcd008c774a8d76e6fc39bebb6dc087c58d6e6ded215e4a5c7d4fc024

  • SHA512

    426fec599ba5c41e225fa4a1cfd9d59a7950d29db36bce08ebab8ba2a0fcb8ac946d251621caa79a7a399da3cd7872c5f6e3bf68058ff7c59b1f82499b9cb277

  • SSDEEP

    49152:ttuJjv45CSCuEjruzwMWU3/KTikgTmISvhp9:463CAwMWU3J1y/

  Score

  10^/10

  amadey0e6740evasiontrojanriseproe76b71persistencestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2