Extracted

• • Target

    11454acefd8d11f4cad356dae7295fa47553827f8f369c108f8f2320ae37e734

  • Size

    1.8MB

  • MD5

    06fec0c258ccb923713aa0007a933baa

  • SHA1

    31694babbaae60f5062c850cce2e9198b097f4e5

  • SHA256

    11454acefd8d11f4cad356dae7295fa47553827f8f369c108f8f2320ae37e734

  • SHA512

    653f1421047681b212bf5c34862c993a6031f9e33a4cc75c716d3eeba6d0988858f7396c8ff82e67fe17d6dcc948dd8ab74c93e57748ac4446be7fc9576a1382

  • SSDEEP

    49152:YvsHwxOHLJTuPiwr3oZX1Bl1stWgtYdhGGuuOfS:E+wYHN6qZlBbH/fvCq

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2