Extracted

Extracted

• • Target

    94445f963bd7a9725a78fb0af7f41375ef9195791ce259f8b1497e93e0dd4d67

  • Size

    1.8MB

  • MD5

    20f6e23944890a5a662588c9e7058aca

  • SHA1

    36c7e7d7bf4fdc94161083f2719bf844f2bd13a8

  • SHA256

    94445f963bd7a9725a78fb0af7f41375ef9195791ce259f8b1497e93e0dd4d67

  • SHA512

    4bd8ce9840139fae3091804f40da9b27e6408b0645edf192620560d0fd02ff0042d2015a2e27ee54641ce0c604cab351976366af8f5c24161b03b58c3cf6d2fc

  • SSDEEP

    49152:AwDGK5uPtc4OR5OBRc+88gpQgExaDRnv0WaLxrBd:A4uPrO4ywOEaDxwx/

  Score

  10^/10

  amadeystealc4dd39ddefaultevasionstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2