Extracted

• • Target

    752b0bfeaf55f0a8df7470384e252b4f31692c2a30b184c73f2f14b86f875042

  • Size

    1.5MB

  • MD5

    0376c95769929ffb66bad255777dec8d

  • SHA1

    4ce7b7db01016d7a6a151957ba31ba52bba846f4

  • SHA256

    752b0bfeaf55f0a8df7470384e252b4f31692c2a30b184c73f2f14b86f875042

  • SHA512

    e18239dbdfdec6656e5624212f06b6f1bff20f57f373a164813dfc7ac0cb132d30fd19d029106d939bec8cafa0d0f3ab74ffc581186c11f63955e58c577dbbb0

  • SSDEEP

    24576:x+ZOQTe732fo6Ar6MpiOQlzd/3nvmgytE9IrywAkQDtZ6l1iM8SErFfP5t23QkIK:8jTlA2MxQJdvOJ69uSXR21iM8SErFfN+

  Score

  10^/10

  amadeyevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2