Extracted

Extracted

• • Target
    jaffacakes118_449173a7e2d1d4a518d096a910818becf33400cdcc17e0524620a549d72c6616.bin
  • Size 4.3MB
  • SHA256 449173a7e2d1d4a518d096a910818becf33400cdcc17e0524620a549d72c6616
  • MD5 26f29489a3a6e20966311b26cbab79d0
  • SHA1 26eddc610e53d27e970bb18671f579eae8abc2ca
  • SHA512 d8cc18beeef9786f6aa7cbf45b2992f9893bb9a76a8d9f46f44dfbf760d755fa89bdeb59c349a8afc9ab091d10f4ad050cb0c4de52be80d77800274defa8c4d9
  • SSDEEP 98304:ZmeG9FWEahYfjyog/Rts5bN4dQ383f0KwSqtIqwrK+FUnQ:Edz1t8aS0KwBIzf4
  • TLSH
    T146263347FBEB4832DE39AB3118F752D35838392956792732A747AC2809BF13466B4F11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543defense_evasiondiscoveryexecutionamadeylummapersistencestealertrojan

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1