Extracted

Extracted

• • Target
    HunterHotmail_patched.exe
  • Size 160.0MB
  • SHA256 5bfc39e6deffa653a902d3a1c0e7eb1ad08911a894b2469a7c165e2629df3584
  • MD5 13d4816acdf0dd913d73f465bb3c6828
  • SHA1 006986477ed7dd5212c1ebc38bdd8b03e74c970f
  • SHA512 4d3b1d9d350e0e3b54fbd2d03f5d3f1133ebb8051ac4c45be680d3d765d6016e09723ce7bd360c1364945cdd55986eb7da85deb52630318e3b4af55030625f2f
  • SSDEEP 3145728:/ksgWP0uodainA/GrSI2Q3ua/mC5022a9J2KldhArp4cRBbDSDF1EJjXeXJJ:/FWuKainA/GO1Qr/7GHgP2p4cjbyX2eX
  • TLSH
    T10B88332D64E50EC2D84CA0B8DB67AFF9C1DF79334552ABB903A48405E012FE5FB6548B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistencespywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Uses WMI to collect hardware manufacturer information

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2