Extracted

Extracted

• • Target
    file.exe
  • Size 4.2MB
  • SHA256 3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50
  • MD5 4b4e3520f6127c1c65fdd8b3ecac975e
  • SHA1 bbc427f63445d9fa65fb10859ac83720fc147e8e
  • SHA512 0bc6bf3b2439bbe0c4fc5dde8783edcee0ac67672fe8dd19d1f0a2c3426c4f04c8292a3e40b79ab8997d70aea5598b483f3d1229907b7dfc94489a95a40eedaa
  • SSDEEP 98304:FW+GNNftT3R4w3K6tZSaMSs1eJMn7w08BKAqffmj:Dkb2w3E16MiBrUfm
  • TLSH
    T1D11622107D56C032D56251B21F79EBF285BDBC21AB3149DB77C01E36AA211E2AA31F39
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543collectiondefense_evasiondiscoveryexecutionamadeyquasarvidarinstallerminerpersistencepyinstallerspywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Detects Vidar Stealer

    stealer

  • Modifies WinLogon for persistence

    persistence

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Disables service(s)

    defense_evasionexecution

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2