Extracted

Extracted

Extracted

• • Target
    572d806c0b56d27fe05562301de6a9ed45cda3f36aef2f6e370867d9f3847013.exe
  • Size 1.8MB
  • SHA256 572d806c0b56d27fe05562301de6a9ed45cda3f36aef2f6e370867d9f3847013
  • MD5 457d9a15d305df62fe34c5076f3cad9d
  • SHA1 7a068fb1e761874759a89534f39c1eb109367448
  • SHA512 5d1f7a3071ad26ab2f2a3b163770a86ded232b038cf05ae9195690bd784f9d5a1d19143add444756184e0901d0bda759140af9ee35af75d1e905f3ba493c0e01
  • SSDEEP 49152:ReTfFaz/B/1mN6QUASzMvovH/ifnqXkTZROKjVprs:69a+N6QU94oCfH+gvrs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0657d1discoveryevasiontrojanstealcc7817dlevastealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2