Extracted

• • Target

    tmp

  • Size

    2.2MB

  • MD5

    1d32535deb1c523d0be798ff37593efa

  • SHA1

    af8d446c2b97ee254b06924423b17cd95e8c0d27

  • SHA256

    58233388d4840d05814fac8b1d2c844c2d224a013194b1cbcfb8a7adca6e18a1

  • SHA512

    3aab24ce42cc650dafb71f68acc0e63c92a8c87e6d9eef653d2eddc36891801fb03ec0dd70c7d8feff03aa27560e4bce7d7bbff6abd44ecbb7f8f893f429a085

  • SSDEEP

    49152:HM864hpl6/xzfnZHKEI92BtxHWfq7918JgFOwZko:s81pg+EIYBtZWfq7918exb

  Score

  10^/10

  amadeyevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2