Extracted

Extracted

• • Target

    8298e07859dd754ed841bf9ccf089d615c99781fddfe276384be906f2d12f8da

  • Size

    1.8MB

  • MD5

    5cc3a863d3a74972f71a6763c5eb3d71

  • SHA1

    a0cf4d2ebc2435c9cf25916a0b6fa46588d321e8

  • SHA256

    8298e07859dd754ed841bf9ccf089d615c99781fddfe276384be906f2d12f8da

  • SHA512

    f8773ce6145ec7732aca641da19c0a215db033f24f35d266ce4abae561657028fd80fd48923baac4237842b96c93bc2fec370843258aa60fd4a58117cc6d8ef7

  • SSDEEP

    49152:cHdxg8zFspdvwbY+XZ4t1dd021ePoAukIqdnItjb:cHdipdK4t136o4nIt

  Score

  10^/10

  amadeystealc0657d1defaultdiscoveryevasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2