Extracted

• • Target

    24215bf60eb7eba8c0e01441d76bd410NeikiAnalytics.exe

  • Size

    1.7MB

  • MD5

    24215bf60eb7eba8c0e01441d76bd410

  • SHA1

    72fc342eb06923834d636a3f8ed6c60bb34a162d

  • SHA256

    55428d7ab21866ead8e96311f3dab6a5e93540e81e59d1899083db0d2e829893

  • SHA512

    c8a9065183bb438a42b3bd68ccdc2908aced971058f2cdfb4adf16d0e09a1bd7535dfed9d43b70a25a417ace717335ce97a8eb524bedeaf4edc028015428124f

  • SSDEEP

    24576:dTWbrtYJ0iEW8sHg4UQmVh0VyzxfuT3Ckh22prGviyBKT3qduVIzuSYpLzKOb:dTWNYbMQmVh013lEuyvirTNVIdyb

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2