Extracted

• • Target

    9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4

  • Size

    1.8MB

  • MD5

    c7f6fb7822a4e281ba6ad23313d79c92

  • SHA1

    2a6a9e04a5f9419c3742cbe5f44cba2e02bbddec

  • SHA256

    9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4

  • SHA512

    57ebdf7507f18b5f9bf04248fad1397862d638f77152f683c941e71b7f6fad2116a48cffcf4a78793d8267b4113114934289111b2f846a3b2bea0e48bfb83790

  • SSDEEP

    49152:MhmFyCGytJt9uczgZWzQdX1ASJ4YXs2JWaUuFS:MUNbucSoQx9PsatUu

  Score

  10^/10

  amadeyrisepro0e6740evasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2