Extracted

Extracted

Extracted

• • Target
    15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
  • Size 1.8MB
  • SHA256 15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0
  • MD5 b23a126d9fa0fb4a8dc0ac3ddb0b3272
  • SHA1 ac11ca5683a5942539f7d9a50a5a31a4fa18e5fb
  • SHA512 8ee2711103b14a23ac97d45bbb81fc05cf2512eb70bfc506ca35c5efcc76f6d14ec7b5795ae6c4995e50edd6114d974d1afce610e75c1eaa8da56744b157d2a1
  • SSDEEP 49152:fa7ngGIcABweSN6gChLr5qugO/nR0LUrdz5NXcPnzEkZOrTwC4v:bakweyWLXgvYVHMPnz3ZOvwdv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeystealc0657d1c7817dlevadiscoveryevasionstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2