Extracted

Extracted

• • Target

    174d7d4381e2eef5735dd218e94ab1225d1e4334398e8a9357476470393367fd

  • Size

    1.8MB

  • MD5

    987c7241d163230bc4b71b245d5568e5

  • SHA1

    841991d788950ae7de7f1be61d8056a6acaa63d9

  • SHA256

    174d7d4381e2eef5735dd218e94ab1225d1e4334398e8a9357476470393367fd

  • SHA512

    05b2eb677751c6b89ebcd0b240e75a2f7c823924f93ec85e1c4c886274336f4338d7edcb0fdbcf814749f918ade2827171af2d33f7bd8756272e1d22097dd1bc

  • SSDEEP

    49152:+k8ytaOKhTRlFB2I9wZmX2rXFNyw8O98YK6b0kt:54OK1hB2gwZX/78O6YKM0kt

  Score

  10^/10

  amadey4dd39devasiontrojanstealcnicediscoveryspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2