Extracted

• • Target
    jaffacakes118_d4e060f62aa171358eb308f8231cb7e8a51c4390b37e84d814531b86023f598d.bin
  • Size 2.5MB
  • SHA256 d4e060f62aa171358eb308f8231cb7e8a51c4390b37e84d814531b86023f598d
  • MD5 0ea4149db17894334f472e1d44c37459
  • SHA1 d73e4f6041fce37006212489941ee8965a91dcc0
  • SHA512 5d2e9276a9a9fa24f4ac64b27b09c8e8b4b30cce33e03bff978742f7556fea2f9274750a5763f9439004c934a3e62bf333f741a6487fbd1f4ad1eb0449c73fcc
  • SSDEEP 49152:+M0iBJ2Tpc8iYMCJzBWENRrFX2pVCdAksnWCp2XCkl:NoTFMCzjNlJisdAksFk
  • TLSH
    T1F5C51230F1C56833E25A9673BFF1D61035BD3060DBEC56966380763CE5629F0B9A938A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543defense_evasiondiscoveryexecutionamadeypersistencetrojan

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies security service

    defense_evasion

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2