Extracted

• • Target
    8444a4843eae3e67f6c5803b61bdae3e9e6312d6d7375dda0631efff88f28e46
  • Size 2.5MB
  • SHA256 8444a4843eae3e67f6c5803b61bdae3e9e6312d6d7375dda0631efff88f28e46
  • MD5 a44b48b8a1d8c060c72e09b5a7160ac8
  • SHA1 fff559be98e141598af0b1ac0d8c0a3ceccf2b67
  • SHA512 86d4117ff4fdf4c03f0abcdd4038eae47c0c5cdb837bb5069c095d406154e004021386199a77bfb8cd1ec035d4695e5cb2ab7e712a2271a0b5728197c16b2433
  • SSDEEP 49152:lT49wWJlSIsb7eDzzDBJtTpc8iYM57G+vSVMZ5i6BEC8ysTVeuK+hl:FcwWJlKSzz9/TFMYqZwhC2Y+
  • TLSH
    T19EC512382ECBA8B0DDD6213943765602773E7D619B6AD9EB03C0E17D9C19482C46BF63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543defense_evasiondiscoveryexecutionamadeypersistencetrojan

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies security service

    defense_evasion

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2