Extracted

• • Target

    43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825

  • Size

    1.8MB

  • MD5

    ed77409c8f8b66f81fae0754ee9d86f7

  • SHA1

    d2500b7585bed8dd179e84f73644a5b2afd8c8e1

  • SHA256

    43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825

  • SHA512

    1208c9dbc61325d2110ba9057ed1a0b4f94103d82fe172a5f40614c3a8d5621f8e04b73784bb70965acd6e38e9fb604e29f52cb8f04f66e5923cd4a06cc9fe92

  • SSDEEP

    24576:GqS02nN1gZ5woLL7hI+b31tDiiMBp9fHfyk21adtXUzXZKktlrfCNK20x2+MI9pN:Wg5wABzD1gf6FIdtXUNDfCN10lV

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2