Extracted

• • Target

    ce39a935e8fbefd607802b4e5021f8465ac9f5a477671f3ebd5c2a6589998425

  • Size

    1.8MB

  • MD5

    9b52255a5088dc893cdbd563636b1d00

  • SHA1

    a5569645eec3e6b587c0d97dd44df0c2b26dfddb

  • SHA256

    ce39a935e8fbefd607802b4e5021f8465ac9f5a477671f3ebd5c2a6589998425

  • SHA512

    2c6c5b048b7ee5a40b98933e87f041e940b794cdb7e6dbfbaba7c0fc61b131a5cc1e0c678a31a7175e6f2f88617900a76e4c9bbceb15640f033793c4a9e61f8f

  • SSDEEP

    49152:Kanjkj2QLMc5/oaAbdgMeKgAxALsn6E2:K12YxouAxZn

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2