Extracted

Extracted

• • Target

    07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4

  • Size

    1.8MB

  • MD5

    30ac84841a731fa47a3ce25033db8449

  • SHA1

    7c2c107362576bd653e0dc6f96be4d7295d70889

  • SHA256

    07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4

  • SHA512

    d56c10c8af777e516ed343544c7b17eb5b1a9553c283da53728013adf1e5d572cf290be6502d25b42f8b617b36a754c39a320dfa4eb545e382de3689a3547e9f

  • SSDEEP

    49152:g5kAmXhdOEgEjSVfpIfEA9fXK92mGWuYn7KU5:gW/sVsdWLnGU

  Score

  10^/10

  amadeystealcc7817dravediscoveryevasionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2