Extracted

Extracted

• • Target

    1b375c9362a4b17bf650eb436b828ab254c0336133029564151a041c80653e38

  • Size

    1.8MB

  • MD5

    5e86c315dddb05f8079aa823fbceea7c

  • SHA1

    42d33d7f946ea82e5d320a936c9971295fc3fbe6

  • SHA256

    1b375c9362a4b17bf650eb436b828ab254c0336133029564151a041c80653e38

  • SHA512

    c61916b0d4dcfc3981bf7b6d77cbdb81a3b68b66ed5c0767cd704886128d66339122db71208b0dc6d5c67882bd3b0895441a0bec326e8f4dc422d1a67818f4e3

  • SSDEEP

    49152:mH7xfg2ZxK/yn1aOWtr2Cv2M429dkpfx2Ob+k8:mbVLXK/41rWtdvkpfx2M+F

  Score

  10^/10

  amadeyrisepro0e6740evasionstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2