Extracted

Extracted

• • Target

    ca7e586c1c7da384c3568e0b85bc25eb40679eac1c5822020ae23479ce7792db

  • Size

    1.8MB

  • MD5

    5d8db7f0c0a8012c52645788c3b45bb3

  • SHA1

    97dc9c3f109f7df727c53931f919a0fe12896382

  • SHA256

    ca7e586c1c7da384c3568e0b85bc25eb40679eac1c5822020ae23479ce7792db

  • SHA512

    1dbf1829315df0636b99bea3c83134726e382c1db2c78f32d38cac74c7b5617f2564abed6fe2920009fde682a01e79108f62b0ee0925645847de76cfdfb2e9e7

  • SSDEEP

    24576:HAFe3VaOVG6h4xx7XjCLCJcv5EyQebU+aBpj+d5/yD3I/JPqaMymIzcoegP81q+O:HAFcVU6cxHACcEmbUIPVmIzJPgZ

  Score

  10^/10

  amadeyrisepro0e6740evasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2