Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 34KB
  • SHA256 5d11218f67cfe78347280b0e1a06ade63c890ac78f970f57b0200ff5be8aa77c
  • MD5 4a8e1e703d538aa882b235ca98802b0c
  • SHA1 f345d138fac0587944956260153d70416e2492f7
  • SHA512 88d1e3bd7023c57d4667562ed128a8e9c71ba86a5af1748c8619895007512a88d77a6dc3bee6520c377dbf30dd493f6aa102c22f2c8bf7145f44fde90ba17dc9
  • SSDEEP 384:RAqgGJZXH01fV+VxsTyf5YfV8ctMaV7EeZ+7jWH4oDB3IdlkELRPR9zABf6c1:RBTXKbTe5SVj3ZC3gfQ9zQ6g
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  74a65bdiscoveryexecutionamadeyhijackloaderloaderspywaretrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3