Extracted

Extracted

Extracted

• • Target
    53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
  • Size 1.8MB
  • SHA256 53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e
  • MD5 0f2694844eb16391e15196e17e545f0b
  • SHA1 cb6cbd6a90349afa4624a221b3350af44feb4d71
  • SHA512 51179c080ce6dce08e8c78e392e20d283c0052e91ed3c4c651b9e53741a3c720f6e87d393eaf0cf8bed54a85d4c92699910b5d0fe237f8dbdcc75d6fe9cd3cd6
  • SSDEEP 49152:bxqFd8IXr3G0NPQQdiwHm+34RapwXKby8Y3O:bxqbhrGoPQQJHlp9Ye
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeystealc0657d1c7817dlevadiscoveryevasionstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2