Extracted

• • Target
    Simple Checker.exe
  • Size 24.9MB
  • SHA256 afe46999748f64442631212d001564f04af2526060f914161d25992e619e3802
  • MD5 5909ec156143e7c049bb2c4225f7e84d
  • SHA1 7defb9761982a91fd76aeed19860c7689cb2dac7
  • SHA512 e5717354b216227506dbc7c8cbb03490f8080a17610ed0c5912ca097bf95611cb10a4de017690e655943b60e05a68cb89b91cddac3f56e298fed5fe9c1659811
  • SSDEEP 786432:YxVHh/IOUMJl0Fm9YxLrJGzzWK7xdXPX:YxVHaOUMJ6Fmu5iLX
  • TLSH
    T1F047235A288C526CC0D1D230D60A7EEDE1E5F9784D391C1A7FCE1E607E3BD45C4A7A2A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  defense_evasiondiscoverytrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    skyline.dll
  • Size 16.5MB
  • SHA256 ee164a9ea084d7a775df11b694ecdaffa3fb3ab0a4f1edf718c8c726d01d07dc
  • MD5 d9197f72448601dabbd58dbe29ba0de5
  • SHA1 c09440596d5fd294c03e3a89f5f260a880b0f2c3
  • SHA512 fd3131a4370308e60eef5ffd81829fa1ae852e6fdf4e653687a0bef2d1730d078a63fca57755f1ff5d03232d52aff06e85c524f1a4ea35171bf8cba47dcc5a44
  • SSDEEP 393216:yw9EQ4S+Nv9f+aphnvhWlrwbt85x6sA8LZ2:ymEI+NvJ+c4lyuL61
  • TLSH
    T14A0723D379D5E1E8C4C79B005AC72BC920E5B28A91FE9A1E3ACB5C033530E57CD4A976
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discovery

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4
• • Target
    skylinesloader.exe
  • Size 26.1MB
  • SHA256 046c4924818902ea213e2077a7257eeadb388ac3682be1c6621274c2cab45bf2
  • MD5 3e64e525e33e8bf7a983afea6e802648
  • SHA1 a5ff714e1cfec995d946ec20ad5c1c1f616a2ec1
  • SHA512 a60326dd77b6e37d05a533e65f852bc69cba8b7988072da12fa928f3d4b9f38b91efa0f77fb8d3cd91045a81e22207e6f2b23df6d6e32dfdb52f6fbf7ab63b8e
  • SSDEEP 393216:rgTs57q4kzztgkntS5lAuL8MArsVQ4+16GzAZ6n9c9M5Qmd5YH0XZz+2Dt6i4LfQ:rhU4kXtBtsP4pYGP9ynmd5fZzs5Q
  • TLSH
    T1F657335A32919917F460DA72C8040598FF72B8321BD0DA3A4917B1BABD1F2FC7ECE645
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  20x09x2026discoveryamadeystealcinstallerpersistencestealertrojan

  • Detects Stealc stealer Version 3

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5behavioral6
• • Target
    w64ms.exe
  • Size 26.2MB
  • SHA256 30baaf04f06726e3a6f59c2fe1ad02400aeb7725d6f5cb429a357a9d77cbd24f
  • MD5 890201956abbc6e3ddd213f337193f74
  • SHA1 e1996d518e2d16fa35b9493458c0814e12e7d4ba
  • SHA512 a8735447d1e1e8ea0ed94b7d29d2c88ee45d731805b9994c26fa23f9f41c35f7ee324d25099b35e82e4dbb503593f39f4db73a0d7d8c5d6e74b1914181a5cd1c
  • SSDEEP 393216:5RCYlDOveP1jAPMS2rYxCwdq1B7QzCQFHsOutn7UpMQFXXp/q8nlbRO4Y:TCWceP1jAU50Cwg1+zpZ6ncMQFJd3
  • TLSH
    T10D57339806B156A3EEA5B13945B3C2B3A232BC505B52844F4BD87EE73D770E10E3A7D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  • Loads dropped DLL

  behavioral7behavioral8
• • Target
    w64ms.py
  • Size 4.8MB
  • SHA256 7cb302b223b3e8abbe31ca48bc66e14c906fc2e39ea5b41b1fa4e7d7872f1feb
  • MD5 057f9f92323eeaa35d1ec241da8579fb
  • SHA1 56f5c1f093dc08971f33ad23c690ca5a78072166
  • SHA512 8e58518c02f7da2dd98c2a979fdc92bb5c832a31d969e02c9eaae5e119f5991eb31f5796674037f153c7456ec2497cf864db76f88fba1f5c91545681ceec2d1c
  • SSDEEP 768:bTQMASgCyi0Ds/Dl6xfkdZ1JmFz+yxREcqrLQ0lPEwme6a1N9dgjHlh06oTpge13:9
  • TLSH
    T161366BDA1E8CDAB8C76FA464844F9D4BD78E931E221FD540A7EF2E463527C6870B94C0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9