Extracted

• • Target

    25fee0705c845d42b1b9fd2b3273808e358587d17cc9706dea565a2e68c10a52

  • Size

    2.8MB

  • MD5

    8c51fab20bcd068ceee453c05b007538

  • SHA1

    ab51d4035ba9685d9c13f295403c5456a7cedd27

  • SHA256

    25fee0705c845d42b1b9fd2b3273808e358587d17cc9706dea565a2e68c10a52

  • SHA512

    9534527e8e2d31fbaee83756341792b77ae81f33ab448ead2eef7c1d341138bcb07fe00e3010f25801e21a84bad878e949e90ed63498ab14de7cf81fba76713b

  • SSDEEP

    49152:T8Kw9EfTOhW1MLNVazcXj2FzNC8+CKR6sLZLGKA/HZLrfrwmq2B3tZ3n:wKw9qOhW16NVazQjofUE0ZLGKA/HZLrl

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2