Extracted

Extracted

• • Target
    HunterPro By @Tesulm1.zip
  • Size 48.7MB
  • SHA256 d158866670b2baaa233f2da7b8e4265a836eadbc6845e45e83366f80029d5ad8
  • MD5 242ca9917b051c83be4e07c73c257e40
  • SHA1 db88e403e17bb67507534ee7669e0aecef642c07
  • SHA512 060a9cc655b8dd45517fe9fd56086986e06a3957903bfc0f0cfd83ab44a9ae2b74929b75707acec51dee62bac029516a31c08399032f208e10eb50cbbb6d74d7
  • SSDEEP 1572864:z7OhhqkrEVwUfliG84fNOm6MCE9cmXIlqzjxQR:PoEZf0MO2CHmn2R
  • TLSH
    T159B73344D38D747280ADB733A7EB10DCB78E9BD56B4AE24F4899B9DA60424C5CB43B43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationpyinstallerspywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1