Extracted

Extracted

Extracted

• • Target

    e94eae10f45f98057b3ef22073421ef5042a3afa27c353bded3382f0a2ffd50a

  • Size

    1.8MB

  • MD5

    85f1d1df8bc9f070616fbbb585e55118

  • SHA1

    51cfcb6ed8d577371fc5495b7e5ee1e6f27f2b49

  • SHA256

    e94eae10f45f98057b3ef22073421ef5042a3afa27c353bded3382f0a2ffd50a

  • SHA512

    d96a862d42b97b48d439cccc86a693bf062af2ffb31539be203d10a6b351e4f93aabe43fb734370f9bc54b341d58ae9ba940f32f16cdad272b57e6a1e831048e

  • SSDEEP

    49152:nVf6Xwdg2gm4oZa+GeHSscdZli7rODBN5SAy:p6XV2gP+9avl6rsD

  Score

  10^/10

  amadey0e6740evasiontrojanriseproe76b71persistencestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2