Extracted

• • Target

    c54fa96e52962604a497dd6b2fa3f9e0_NeikiAnalytics

  • Size

    1.8MB

  • MD5

    c54fa96e52962604a497dd6b2fa3f9e0

  • SHA1

    0c26bb2a91e8c8f07c94afe5801869560cf81bfc

  • SHA256

    228c6d0bbfde6515ef2331d54661e5893b1eeb211fe139c637ec0868f3f130d9

  • SHA512

    2aa1d42e6e0ae564f859016f0f4d4f8bc660ed485699a6d3179f5952312544bad5a59140ce8e03cb23b27759f580988158c6b884990d59f2443a574fd7fb134f

  • SSDEEP

    24576:43xjv7MZIpzDXKkPsbxuGLmSUiIwZ27ZHlke1xZ6G3LT4ZdSSB7l2ODTyQIDDS:Yvc0DPsu2OwZ2rkoj6WLTidZZ2OfsDG

  Score

  10^/10

  amadeyevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2