Extracted

• • Target
    7af10f327720f136368e154c99746d4d1f72a7f43866d8f253bba29f69d3faad
  • Size 1.8MB
  • SHA256 7af10f327720f136368e154c99746d4d1f72a7f43866d8f253bba29f69d3faad
  • MD5 3ae6e695122e8ab6fb7259f783f29f46
  • SHA1 a9c0b2ffe00b19c4c9f4659cd61029cb927b69a7
  • SHA512 eb09ad5ac3538dd16c910ce91285f58887c18bf257067be71fd56aa8081fc2fe2fc340ca625e901c61a0344d55c60cf07aa0a952d79fe3bc22681a15caa19654
  • SSDEEP 49152:ut1Q422doIhHSTOYayAUx2IvStQnNfSFe6UUi:SJhHSP1xN6SnNfxU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2