Extracted

Extracted

• • Target
    Setup.exe
  • Size 118KB
  • SHA256 42f1f931507234ddf6334300cb08e6838a823003839cdd8adb35d69836011eed
  • MD5 fac003a7683096d3db86ad4261d6ffdb
  • SHA1 b493722feae29c5be668b47ea506c91e718c6db9
  • SHA512 321b749cc060aded0a9f829c4307c23774a810c48dc8bd36976455684545f02983288b16b6d5eec9375926462b79d50ef6f164987c4fc5164b0b08aafd97a0b3
  • SSDEEP 1536:E+6X3jTB/IrgszxhuUQwuI6Zz9zLwLi3lkBhRhgn2WaXCGJ4eTw4ieLU9Y5UhX/6:gDScmwZz2Liwporew9Y5UhP6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  4e7b51defense_evasiondiscoveryexecutionamadeyhijackloadershark_stealerloaderpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects HijackLoader (aka IDAT Loader)

  • Detects SharkStealer payload

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • SharkStealer

    SharkStealer is a stealer written in Golang.

    stealershark_stealer

  • Shark_stealer family

    shark_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Downloads MZ/PE file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3