Extracted

• • Target

    OneApp.IGCC.WinService.exe

  • Size

    5.5MB

  • MD5

    0cb7d11ea511391d791b0fbb9637ee79

  • SHA1

    96c13496ad8342bdf1cb0ffbe59f673c8395e99b

  • SHA256

    502129a00203367b15d57f87b5b51d01fb292928708decb723cd7ad866a7fda3

  • SHA512

    8823a02a66d883cb7bffce5f4c93a216dd3280f5f65b340b00b8d6e72112327ef4e64fe6cd3c43dfe3dc7e241d19d4ea98bc9e9e3d49ca2818131920b4093aeb

  • SSDEEP

    98304:MXu+i79EbSTjewAV6G67Ngr9wZZGBysnji/MZ/HqLGdOVnhamYMNwHYo8C4Esg6:MXuzCSTqwAV63Ngr9w6Zj5lHkG8hzqHw

  Score

  10^/10

  amadeyhijackloader84fc95loadertrojanexecution

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2