Extracted

Extracted

Extracted

• • Target
    753679075D41A3418C419AB93534957B.exe
  • Size 4.5MB
  • SHA256 2591378c3dc6d559d1086febc5bccd77dd23aa3666a70ff450165e52b0db2990
  • MD5 753679075d41a3418c419ab93534957b
  • SHA1 2c30be88fc2263ee8898411ec1265ac8b8f83ac4
  • SHA512 576496af094aa56ba82e334a3185151a803ff7e4da0a6ee1a44051941c92ecc5cf279778d58eaf0be4eeef9ad014a852518908a00946b2779c63c8a6c560a36a
  • SSDEEP 98304:yC1NKDIpW416/cj4F8q5hGzzSDNWyb1Td4UNqq6Sg2i:yC1zW411jC/hKYb1Td4UNqGg2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defaultfbf543defense_evasiondiscoveryexecutionamadeyasyncratlummastormkittypersistenceprivilege_escalationratstealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detects Amadey x86-bit Payload

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1