Extracted

Extracted

• • Target

    e8f9bc3254f0cf32f92b1b06ce0a9e00f3e58478c497cea43d942115c7ed8a64

  • Size

    7.1MB

  • MD5

    cf2cdc1397ecdd08593a3e59a5321677

  • SHA1

    433561b5e8c1e039309299f8155cf16ad64d150a

  • SHA256

    e8f9bc3254f0cf32f92b1b06ce0a9e00f3e58478c497cea43d942115c7ed8a64

  • SHA512

    01d8585df1cb2b56336767c7033b29dee9f4017a577bea508c1eef8c9bccf67ed14a3b61d0805ee55c4e7f935c0bbe7f1dc8e9e19bec08a09114747dda05ffab

  • SSDEEP

    98304:C0YaGkzVJosUx/J7DADxyLYuqiQi6pmYP85Cv9xzEoUJJqF08uvBx85UtHJjVt/L:CoSdJHADxyL6LpckpEo88uvB62tpci

  Score

  10^/10

  amadeyhealerstealc9c9aa5bratdefense_evasiondiscoverydropperevasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1