Extracted

Extracted

• • Target
    ProxyLeecherbyAlphacrack_.exe
  • Size 16.1MB
  • SHA256 e677a9da84b5b1a612abb286c046b17dd32f1dda2892a16a82e6ef4605156a12
  • MD5 a8983bbf9737642d5ec6470ed6c9067d
  • SHA1 22fd3f8cbfae785650670ecf5b7de8f973c9c1b3
  • SHA512 ba62affff6f150e4e76739ac39c64cb135d0a044a2c0c84a18629ae5ac85845f86189d34cf3339a9952a3fd4892b449844165cd5bec7c29c141331b228ba5639
  • SSDEEP 393216:MHDiN8DWiXLYEdYHi9WJdoyMxtDDAx5w5EpELVHWI3DA:Q1WiX0gYHY+doy2AHpEtWI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlinesvcstealerppvvdiscoverydownloaderexecutioninfostealerpersistencepyinstallerspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  behavioral1