Extracted

• • Target
    0a7f8a3e8e5c4e70f7ec2863a70c95e0.exe
  • Size 16.3MB
  • SHA256 9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe
  • MD5 0a7f8a3e8e5c4e70f7ec2863a70c95e0
  • SHA1 3e6bcfc6a14a1e60459cce6625b6354ce5428493
  • SHA512 3051bc598615a1fa456a420aa28529aa8aa99c6487d2c2f98989587205f4564fe0ebf58ec65414f2e069fe9a73f98b735b5f92ad7972800870c7ca3f61c3c9a2
  • SSDEEP 393216:9JvdVFh+3l3Y7My4QtgEZOtd+r0UXqx6xJlQW:3dVkzhQKN8j6yD
  • TLSH
    T15E07330018D72CC9F527E7FED94116099EBAB6606608929EAA7A4F5A1F3F173C177330
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersolaris_loadersvcstealerinstallerloaderpersistencestealeramadeytrojan

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2