Extracted

• • Target

    91a22f5eb474089fe85060ecf6801900901b1470b5d0976b353a973cc356376c

  • Size

    1.5MB

  • MD5

    eed655bda1ec78d1ca58d2b3e7040afb

  • SHA1

    f6069373366797fbecdf6eabfcdca24e7e132db2

  • SHA256

    91a22f5eb474089fe85060ecf6801900901b1470b5d0976b353a973cc356376c

  • SHA512

    63b53a6e057b15fd44725ed907450d498e8fc59f46cc66e3f0203df4642f81456732cca39c0827c11b3fa7c453bb24adb81e25fe656b27a44d86fe8bc237592c

  • SSDEEP

    24576:vZXTSwIbuTaddShxUpfEArQYeLkhGcxhsnSO8srbuncWulPVK5tW+j1xbNjCja:vZXlIA/UJTrQYFhGGuXb8gQtJh19

  Score

  10^/10

  amadeyevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2