Extracted

Extracted

Extracted

• • Target
    Fake ID Cards Creator.exe
  • Size 7.6MB
  • SHA256 22043550f41ba8a519b216a45469c176430c47090ab8617b9a2c17cf0a8233bb
  • MD5 cc3f500958d4ba691f044a5413610df8
  • SHA1 86ca2ab7d25c092530cbffd072341f993bca9f79
  • SHA512 89d9b3149e51bca8d06cc1988c5f0b5d702dd43a559cf0ce916e7c9a18067ecb9d12532cbc5b753aa038e34a31ecb85c8c1daa2bdad0fad05d0e9de37cfafd78
  • SSDEEP 196608:awTn0syJvuOZ8ni3mT/95WKWfEeW50YQIKD9iim4iiYwPc+:D0pui3GvWjgtQIuYim48wb
  • TLSH
    T19C86331E207DA0F5F15A0E34C061907AC77AB8A437905B5F126E02AE9EEF7C1AD85377
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  292234rundiscoverydownloaderexecutionamadeystealcsvcstealerpersistencestealertrojan

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1