Extracted

Extracted

• • Target

    9335518bdebd925efd0d4eb74316b0306115eefef14586e043f23cbd35c046f9

  • Size

    1.8MB

  • MD5

    69138b3117d495b2d3b97f35decb70ec

  • SHA1

    e9a1b39e9f303fe2fda9da6638a05b714f5c97c8

  • SHA256

    9335518bdebd925efd0d4eb74316b0306115eefef14586e043f23cbd35c046f9

  • SHA512

    1c8c4c24ff4e7e526367f31bbfc781c0325f864a8640432f131a56e351a16c28ab7f383d95d6b3939eea5f4cc177484c3a7ba8dfe01962fe191b5c68db14216e

  • SSDEEP

    49152:AKtQNbj6jZ0K5ggUqcirkNbl7s+eDEOpawrQ:AkRUqcirkN57epawrQ

  Score

  10^/10

  amadeyrisepro0e6740evasionstealertrojanpersistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2