Extracted

Extracted

Extracted

• • Target
    1.exe
  • Size 1.5MB
  • SHA256 cb9bd04a140f01165856fc726e03801c3d757a63bfda2b8b4638d2bfb726d089
  • MD5 69976693698f8baa72cd9833cc56b5d0
  • SHA1 079fc6e2011066f19c8dc1eec485415d7904d65b
  • SHA512 7f23589306af72a89edba818d9f51260b88021691d83120737a03a83859b640cb31907a0da88aebb6174fb77e15774c235a3eedb47c4f907a093738c82444518
  • SSDEEP 24576:epzw7OzJyp7giHQR/hN/oEGSE8c1aZHo+aowaEoV8dTI9OiXK9CcmRXWZIyjUh:epzwS8hbHQTN/oEG5Bo39HKYcUJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  30x08x2025e3db0bdiscoveryamadeylummastealcpersistencepyinstallerspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1