Extracted

Extracted

• • Target

    59d0d8fe533cb88d822c8b2b253c7037b2b3a7011e80e58000b360310168082a

  • Size

    1.8MB

  • MD5

    f36dbb4972da4ffa0e4d7dd3f1b84e18

  • SHA1

    a42b15d10099bd18a39d172c973314feab489db7

  • SHA256

    59d0d8fe533cb88d822c8b2b253c7037b2b3a7011e80e58000b360310168082a

  • SHA512

    0203f41cc382fc1404d7a2fa89cbef57e229e319cda8e73d11b29d6be314f906da6d4f41e546ac8538270bd6ae7251b5a5cf813a324062e1c99dbd43b52f5ee2

  • SSDEEP

    49152:ghkhC2ZizCgpZDLo0He3k0rc82HV5PpaYlTshgX:BC2ZiWgbzd0JIV9pd4hg

  Score

  10^/10

  amadeyrisepro0e6740evasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2