Extracted

Extracted

Extracted

• • Target
    8aa655f97cac46746b82b6dfc7ed9742c68970d802f57625fc01bca88b14a359
  • Size 7.0MB
  • SHA256 8aa655f97cac46746b82b6dfc7ed9742c68970d802f57625fc01bca88b14a359
  • MD5 7804d65280fc1394f43ef02dec77113d
  • SHA1 2e413caca3d83157c26017238bd676d96a5da3eb
  • SHA512 b5a059240ad6e85cacae1fc210d4bb6eadfb13f221d31533fbd0637dd6d69e66839541ba79656c5da6220f184ad95d4381aff7bb0272f27dcb3d676db78b6bdf
  • SSDEEP 196608:vqn5GyraENeVy9x3LHr3GQVnjJ9odY9ZKAQh2e4:M5Gcazc3X3GQljNZ/QMe4
  • TLSH
    T1C0763377A2B840B4C828573D18F143D20A32775D9666AB0B669BE8907C369B179FD333
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  9c9aa5marsdefense_evasiondiscoverydropperevasionamadeyhealerlummastealcpersistencespywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects Healer an antivirus disabler dropper

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1