Extracted

Extracted

Extracted

• • Target

    d0bfb34dd258ddb7dd879faf1e979e1e75a266d63d6eff9036851582fb5930a4

  • Size

    5.7MB

  • MD5

    c4c9e43e08214618f2e9a9040f81538e

  • SHA1

    7287e802614f21de27ddb83b7d212de7f1829e22

  • SHA256

    d0bfb34dd258ddb7dd879faf1e979e1e75a266d63d6eff9036851582fb5930a4

  • SHA512

    8fd9fc6f5e53860200fa0ea6de680b78a59c4fa89e597df037d4b7d2313583592361374ce9ecf4a5832fd605566fb0360b6eadc08e5254114cc9ac6950c04e85

  • SSDEEP

    98304:OEpplnHtsXBeP4wiU7QiK8cOnKxatfUeWV7sxoGa7cRwMAQDEbUoK8wyDX8vo+Z:PpplqXBewwTl5K7D7swAEbUoKOGo

  Score

  10^/10

  amadeystealc9c9aa5bratdefense_evasiondiscoveryexecutionpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1