Extracted

Extracted

• • Target
    5ce0a10fc102892d36697d9a2bdadaacf90e3fd0c002c186fdb0fb6e1b7dea4b.exe
  • Size 2.4MB
  • SHA256 5ce0a10fc102892d36697d9a2bdadaacf90e3fd0c002c186fdb0fb6e1b7dea4b
  • MD5 e7f215365709f75425d39952435f4326
  • SHA1 70542abff63ab8edec1bb720fa176f896b01ffca
  • SHA512 1d7952f85d02b2097eee6c13fdb799a772819650264414789a1d3dbc530a7917d5aaac5beba18c0b442b0fd9b7bca71fabcf8d23754da80d3559555f38af0ba2
  • SSDEEP 49152:JHL9nnyBOjxhEQAWJfm0VzAQ1SBLrbQccnnvbPyx+w0g8:hlnyUDEQAHyzAQ1srbb4cb9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeystealc4dd39dfunnydiscoveryevasionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2