Extracted

Extracted

• • Target
    ElijahMeow_Cracked.exe
  • Size 114.4MB
  • SHA256 aea900c271fdf96edc479fd0398e18b7dbcc8d156c0d9f5ccedf91bae78bef24
  • MD5 6cd9ee8671610c48dfa0c4c001185414
  • SHA1 07a0f51a2fc422516d0db7ec3fcad70025756f85
  • SHA512 534616db7f10ae3570032e5f40d91ad6d390a4e1cabeb10fc22543050a1eb6200603cd088e0cdc2c744d23059936dafb2a4388588130373df2950fad7807711d
  • SSDEEP 3145728:zDTJA5vyemzLCv6HFVanSrUr27IBNkAVzP:zDTJjemzLCyHFVanSrH8kAd
  • TLSH
    T1584833A58E410FA8D90009F179A8390AB5D4F1698667CD3C05DA30025E19FE6F6F6BFF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionamadeysolaris_loadersvcstealerinstallerloaderpersistencespywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2