Extracted

Extracted

Extracted

• • Target
    259930c22bc3c592893b6604fdde6233a1650ce131737a70ab6c66c69a8305cd
  • Size 1.8MB
  • SHA256 259930c22bc3c592893b6604fdde6233a1650ce131737a70ab6c66c69a8305cd
  • MD5 b2f0d9cde6cd1f83091b9f2a6875e6a9
  • SHA1 a7bb83cc3f9edc38751ba908d3e0bf393dcfdfc6
  • SHA512 51bae1077f202a997dbb78e3ece8cf14737362aaeb0e263917a0ba44cfb89cee3b2532c2e5db88151e07c2c8f644be5a4fc3cffb4c6a7f202ee58812afae5de6
  • SSDEEP 49152:38+S7Y13iG6Fl9z0+S92ONgoknqqFwY0OiMl+SkIxsNo:M5zplR0njNZviwYZjl+Yu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeystealc0657d1koranordcredential_accessdiscoveryevasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2