Extracted

• • Target

    5a2cec4e1c9014b11eaef47d7e333d74b24b3809dea8f4742332fdec54654e32_NeikiAnalytics

  • Size

    1.5MB

  • MD5

    b06621cf3c68e539d210a08eb7e42706

  • SHA1

    43edb75c077a591bb04025d0d09a0bad858077e7

  • SHA256

    5a2cec4e1c9014b11eaef47d7e333d74b24b3809dea8f4742332fdec54654e32

  • SHA512

    da63de92955cbc10d880542d83bd1b14226c0032e8cb081658875aad791aa2f419726eb52ea9b1c45f8df16bd5fa3972e560552bd81ef092b4f0feb0754e1be3

  • SSDEEP

    24576:iKFq8zJO+ZEgpqI41vsQTjFqp200bCklu4DbMAOA3OO6Jg0BydVI7ZWc:ij8tO+YIQUyjkpw9RbMP7gtVI7/

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2