Extracted

• • Target

    c5cd940ec4700e84ba44d259944d5460_NeikiAnalytics.exe

  • Size

    1.8MB

  • MD5

    c5cd940ec4700e84ba44d259944d5460

  • SHA1

    5f842387fb1c07574e5700c14c920f83b185e52d

  • SHA256

    531872e595454dc69953ca8976ae8839474adcf29eb7de0c83f88a34c7149c81

  • SHA512

    34d0fd28da1183b35803b9ba28736f0f3633d705f3a6481eac7ae9d76fc3c46f7753f2fe962203740d3190b3f718ab38f742efe121536d2317b95c6203a18606

  • SSDEEP

    24576:HfVdAWQ9LmNsenk2SYUE3Y4EZqvzTfp02E8RGoZS+indPW3in/wSk3p7uHc7xEsO://Av9UJk2Bd62O+uQy/X41W4NFbeDb

  Score

  10^/10

  amadeyc767c0evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2