Extracted

Extracted

Extracted

• • Target

    81a2b8f827201dd63e85ee0826d36413ca5708b13e912fe91b6bcb30539a510e

  • Size

    1.8MB

  • MD5

    67a054f530e13365d7d22de40557c61e

  • SHA1

    e3a035ed41792df542c6ce00a41394b2d60f97ba

  • SHA256

    81a2b8f827201dd63e85ee0826d36413ca5708b13e912fe91b6bcb30539a510e

  • SHA512

    45438dca791bf0f1fe737bfa4b3657822546ed2a7190f23d5a84d5da67f1cd55d4de5ab684db53cce831c33610205ac1b3a7b1d2361966bcbc2b13093ba74f0c

  • SSDEEP

    24576:ZXQpxLIdfOIZcmNEswSX9YPKgP/9LZ3IikNNbrNw+A6YdtTsqgowvTVaPNK:ZgpxUdWIZJtwOdQFZI1w+sDIqgoYkPQ

  Score

  10^/10

  amadeystealc0657d1defaultkoracredential_accessdiscoveryevasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2