Extracted

• • Target
    OneApp.IGCC.WinService.exe
  • Size 5.5MB
  • SHA256 502129a00203367b15d57f87b5b51d01fb292928708decb723cd7ad866a7fda3
  • MD5 0cb7d11ea511391d791b0fbb9637ee79
  • SHA1 96c13496ad8342bdf1cb0ffbe59f673c8395e99b
  • SHA512 8823a02a66d883cb7bffce5f4c93a216dd3280f5f65b340b00b8d6e72112327ef4e64fe6cd3c43dfe3dc7e241d19d4ea98bc9e9e3d49ca2818131920b4093aeb
  • SSDEEP 98304:MXu+i79EbSTjewAV6G67Ngr9wZZGBysnji/MZ/HqLGdOVnhamYMNwHYo8C4Esg6:MXuzCSTqwAV63Ngr9w6Zj5lHkG8hzqHw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyhijackloader84fc95loadertrojanexecution

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2