Extracted

Extracted

• • Target
    RoninUnlock_Launcher.exe
  • Size 41.4MB
  • SHA256 4ecdab130ecfde11f0a30367600e6aec8732d16c18555c4af8d4a9340497d69c
  • MD5 2d007511794fc70babe91b98d6983750
  • SHA1 85252735ffc2ce2e5cb5a82f216cd8542476ddd3
  • SHA512 1865030a75cd872cee71cd09c86c78331fc9f2063fb47616309fe1bf91ee1518d2b69533a29159fd38ecf1dde6e74388862e5b8945aa8dede8c0959b4e881221
  • SSDEEP 786432:mvZ0OynuWU3tS76nKNUpgRGp7ER3ynu8kaqCgKNUpgRGp7ERQe43rwNv7c7oo1YT:/OWQK5Qc4j5Q0Yrw50oUW
  • TLSH
    T1FF97335EEB8298C2D7C2153254D88F7D470637A4EEE53FEEB52C160A22711FDC6A5B20
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationspywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2