Extracted

• • Target

    30805c5e9564511d5f43aa4259460250e0f59e0a4823bc7fa6e18d1317e07f72_NeikiAnalytics

  • Size

    1.9MB

  • MD5

    5f89b335cf25eafade8f46f6c535513d

  • SHA1

    c6c4449d042a2bbb7b96c0dc41053ed1cc7735d6

  • SHA256

    30805c5e9564511d5f43aa4259460250e0f59e0a4823bc7fa6e18d1317e07f72

  • SHA512

    ba239dab919153c5bc3f829d7682ef44cd6446f66591172c48cbc563a8c94ee85a585d5123ea42d556a6414caa0d8bf79f81804f0b7f032c599c7004954d662d

  • SSDEEP

    24576:455EPvLllf9s4pNHQTAOfFFy0d1vyLo8nhtlWfdDCZDBDCIwei165BYGKyI4b:U8jlIgwTF16nvlWfdDQNChD1+

  Score

  10^/10

  amadeyc767c0evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2