New AmCache EvilHunter Tool For Detecting Malicious Activities in Windows Systems
AmCache is a critical component in detecting malicious activities on Windows systems. It allows for the identification of both benign and malicious software execution, offering valuable insights for incident response.
AmCache is a critical component in detecting malicious activities on Windows systems. It allows for the identification of both benign and malicious software execution, offering valuable insights for incident response.
Managed by the operating system, AmCache data persists even when malware self-deletes, making it indispensable in digital forensic investigations and incident response (DFIR).
AmCache records SHA-1 hashes of executed files, allowing DFIR professionals to query public threat intelligence feeds such as OpenTIP and VirusTotal, quickly generating indicators of compromise (IOCs) for network-wide blocking.
The new open-source tool, released by Kaspersky researchers, facilitates the parsing of the Amcache.hve registry hive, automating IOC extraction and enhancing threat intelligence lookups for expedited threat detection and containment.
AmCache-EvilHunter is a command-line utility developed in Python. It processes the C:\Windows\AppCompat\Programs\Amcache.hve file, extracting key metadata entries.
It analyzes critical registry keys such as InventoryApplicationFile, InventoryDriverBinary, InventoryApplication, and InventoryApplicationShortcut to reveal file paths, publisher data, LinkDate timestamps, binary types (32-bit vs. 64-bit), and SHA-1 hashes.
A typical command filters records by date range, outputting a CSV of all executables present within the specified timeframe, for instance, between Sep 1 and Sep 30, 2025.
AmCache is a critical component in detecting malicious activities on Windows systems.
The FileID field contains the hash with four leading zeroes. The Size and IsOsComponent flags aid analysts in distinguishing system binaries from potential malware.
Kaspersky highlights AmCache-EvilHunter's key features, including integrated threat intelligence and advanced filtering options.
The –find-suspicious flag employs heuristics, such as identifying one-letter names (e.g., 1.exe), random hex filenames, and common typo variants like scvhost.exe to detect anomalous entries.
Additional flags like –missing-publisher and –exclude-os help reduce noise by filtering out signed OS components.
This tool also supports automated lookups against VirusTotal and Kaspersky OpenTIP, appending detection counts and threat classifications to the output.
Analysts can utilize search functions such as –search “winscp.exe” to verify the presence of deleted or transient tools.
AmCache-EvilHunter leverages the Registry Python library to load the REGF-formatted hive while iterating through its subkeys and values.
Its modular architecture permits developers to extend support for custom IOC feeds or integrate with SOAR platforms . The tool is available on GitHub for both Windows and Linux environments.
By automating parsing, filtering, and threat lookups, AmCache-EvilHunter significantly reduces manual efforts and accelerates DFIR workflows.
Incident responders can rapidly reconstruct execution timelines, identify stealthy rootkits via InventoryDriverBinary, and generate robust IOCs from InventoryApplicationFile entries.
As adversaries increasingly employ self-erasing malware techniques, this tool ensures that crucial execution evidence is preserved.
Based on reporting by Cyber Security News.