Extracted

Extracted

Extracted

• • Target
    8b76de4bd18371fdc11b923c6ad1056c16d5b24ec28f2c291f362754a36962b8.exe
  • Size 1.8MB
  • SHA256 8b76de4bd18371fdc11b923c6ad1056c16d5b24ec28f2c291f362754a36962b8
  • MD5 0f6e649713cb19b7cab1cdc80df57009
  • SHA1 b44b989fb4af18e2632eee663b9a0e91058a7f50
  • SHA512 4be1b93c8f2cea2ad6eb85955435ecebed2745f619ffc0e35065773d0230443afc1f3b4ddfc3b5e98277aa1cbeb99522b1cb5c42fd9ab55d3c1a888f0e0fa072
  • SSDEEP 49152:zXGRzpVAA4KxhZmqwwUrAecVcukesiCY9jNzSnpAMfGwx:zXGRFVAA4KxhZmqxbevu2wdNOZx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0657d1discoveryevasiontrojanstealcc7817dlevastealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2