Extracted

• • Target
    0a6e2da6f692a1959a76e82ee5985f5eabb1ee8f9848f3b027cbf6089a15d617
  • Size 1.8MB
  • SHA256 0a6e2da6f692a1959a76e82ee5985f5eabb1ee8f9848f3b027cbf6089a15d617
  • MD5 55b351362117f6ae378f4ac4c7498dcc
  • SHA1 3ef71b506a9782286f91068f28a59aa3328ebd34
  • SHA512 36efe5ecb99f70605cb30cacb9944f91e43099072d08fe007074252ba95eed1f9e1e66953270fc1c87e1eb00289e20005badc0ae70880b719a2047401dd165cb
  • SSDEEP 49152:XXnBsXHZ5QtA4paSe5oLHFyhd8XvhfAFiU2:HBsXHZetA45xqMf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyevasionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2