Extracted

Extracted

Extracted

• • Target

    0e07bc965ee6bda04b59339a181b4cb559552053ef828982562e4ecf97366804

  • Size

    1.8MB

  • MD5

    cc55ebdf25425a6a8e1e7ff87e4abb9a

  • SHA1

    7f8496fdb32293620c78d26a1e0b51f60dce9f18

  • SHA256

    0e07bc965ee6bda04b59339a181b4cb559552053ef828982562e4ecf97366804

  • SHA512

    8e5dcc062b5b6234d4506f91a8afa8241b28b15d1e6ba2d3397f706feac511b6c3ada3c76f181acfb527b20031e2670b28ea108ab2ea08995b6d52ed925ce374

  • SSDEEP

    49152:oWpQ+LtcyZ1zOQ18mEq1o1vmsyNSHbTGmp3fxhpeVu:oWhLSyrzONKMpyNOftxLeVu

  Score

  10^/10

  amadeyrisepro0e6740e76b71evasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2