Extracted

Extracted

• • Target
    e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5
  • Size 1.8MB
  • SHA256 e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5
  • MD5 2e998ab684db3c1e906cf4b040f8ffb0
  • SHA1 42fc009d45d469bd24daf70bc7aa74c3b1d47821
  • SHA512 b1162c49fc6ef47aa84e90381ff7a7584e89f4107f1dabe08b5791d0930c3da62d4ff3858425d0e15bb13011da3c49f75507cb08caab12e32640ff68a666d35e
  • SSDEEP 49152:OwVHOHIsg6OPgZMOtMwtWPokPZ7i64O5HFunlXL6LZB9o:Owjt6OPgZiw0P55i64O/unlbUF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeystealc4dd39dhatediscoveryevasionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2