Extracted

• • Target

    37103de9866a15ced147161368b7ab15f102c9bcf339b03cd7ace7a0834f33f4_NeikiAnalytics

  • Size

    1.8MB

  • MD5

    e0d225ea38adc5ba1a3a323d06e4c06e

  • SHA1

    b45e8463cc0945b475320df8929a37ae0c2ea4c9

  • SHA256

    37103de9866a15ced147161368b7ab15f102c9bcf339b03cd7ace7a0834f33f4

  • SHA512

    29e5a4950afd7951eef81fa7054ce26ff002d48cfa1874871967fb5994f488cc8a1e28441397e4dc893f4eeb2e145195cbde18e96080a773197aa40bc6335f16

  • SSDEEP

    24576:3GAoudKsh805tZdeI/jK0xmOcKO2iLUwjaFp8sZcNzR+CrJnz4/wzH:BvhJgI/+0k/KOzLLap8sZclwC5Awr

  Score

  10^/10

  amadeyc767c0evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2