Extracted

Extracted

• • Target
    Setup.exe
  • Size 212KB
  • SHA256 67702ff3b28c29f96912050f2c48ea1c3a74a2276ffbcc3eb85cc6137b247d4e
  • MD5 db55c6dd39cf4e11ce318483c0a316fe
  • SHA1 a3bb10f35dd27f31941c970af2590dfbb1124362
  • SHA512 90a61fb11fa534cd328e6d07c421923699f00158461ab8f1b3976b55a76632003a861e9f4efc965d7f1130be4346841513ae10b7a021a640147c26a598d73b95
  • SSDEEP 3072:9R36Wl7r+LTnXVYcqKS7T/+RvuEyBgFzcyYfjY+cEeGZjcGdOzsQy:9R3VrCTnXVW7TGR2EyBYAyYYknQz4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  6598d3discoveryamadeyspywarestealertrojandefense_evasionexecutionhijackloadershark_stealerloaderpersistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Detects HijackLoader (aka IDAT Loader)

  • Detects SharkStealer payload

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • SharkStealer

    SharkStealer is a stealer written in Golang.

    stealershark_stealer

  • Shark_stealer family

    shark_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3