Extracted

Extracted

• • Target
    ShulkerV2_3.2.3_Windows.rar
  • Size 76.2MB
  • SHA256 e0574bd27168c81fc4397db12ebc5f5f1a41089ef5f120d69647cae1c1956288
  • MD5 e955bc4f11d9ab79fd3bc42dfd2e5e51
  • SHA1 9a507613f902ed998b9defc0480d4035820b4c79
  • SHA512 9d8da61fbd85654e2dd43eccec4e11e4533c87b0a2e3f9872923c280d05ac39cfd473f825039b8c5fe84ead8175a9126b12fe68bf1da312a05d00d8f691ec480
  • SSDEEP 1572864:JaqXWFivEouqbEDTGE8kMdSGff7kK1XI7ZP0SIZXQrvWur:9XWwvW/HMAG3wEXmZP0fZXqV
  • TLSH
    T1990833D3349A75799916EE0ABFED0A10C5CE61972513FDE0725E26AEC70BB0C989C343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistenceprivilege_escalationspywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2