Extracted

Extracted

• • Target

    hdoqgihvw.exe

  • Size

    557KB

  • MD5

    edf87c3498772bd5a73af0baa1fb637a

  • SHA1

    b7b2c8fdd06cad300c721e3cad2dc69bca3bbcdb

  • SHA256

    90ffbc37f8b47bf0d7c629a33e25828c42791133afc754380f1559f2f01f522a

  • SHA512

    a38857b7905210d862ba08f6de0c8a88e9a8a35a82bd61886d6613835f4204d2c12f26c319d720a7b2f6af9c86a35feac2ba621baeb81eb2fdd3ed402b7640ba

  • SSDEEP

    12288:EB1rZEH5kKHBbjfxhEHrtZHw817hA5MWM1jZIxTXxSYGKuX04lxplu+edBZuwRZq:EBIEHrXw8hhcrM1d+BqXhUZq

  Score

  10^/10

  amadeyrhadamanthyssectopratdiscoveryexecutionratspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2