Extracted

Extracted

• • Target
    xf523207e148ae281593de3e82a54f56cc08a661e67889dbc07eb4e16574c7df4.exe
  • Size 170KB
  • SHA256 f523207e148ae281593de3e82a54f56cc08a661e67889dbc07eb4e16574c7df4
  • MD5 9ca86f116d06ab4fb10615083fcb202b
  • SHA1 eba28159b33db8d7947a619628e88f214bb01bc4
  • SHA512 14004146b2a9dc8b2b7410fbba8bb520b79f43f6f8d4e2651679684cc40e7b0b0eb66968bcfc1564a03a66b54472e56559abc1716ba14e7cc3333d57b551bad6
  • SSDEEP 3072:+dpGK8qr61IMTPpcCt0IQuM4Q8YcXuepswkjUq9obMnzXlZsPPR/ZCtZp87NF5gv:+dpGK8qr61IMTPpcCt0IQuM4Q8YcXues
  • TLSH
    T171048C1175D2C072DCB31830D6748EA45ABD3D604AA49EBF27D46E6A1E33BD09133AB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverybotnetdefense_evasionamadeysocks5systemzinstallerthemidatrojan

  • Detect Socks5Systemz Payload

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2