Extracted

• • Target

    fbafbd2d04ccf9b8db353974e764df0d0a3d0691406b70daf7435222271967db

  • Size

    1.9MB

  • MD5

    2e73b9e2765053f0161aa0ea34c6d1b2

  • SHA1

    49f4dc0d4fa2e66f281ca67a5c3dc37b76282521

  • SHA256

    fbafbd2d04ccf9b8db353974e764df0d0a3d0691406b70daf7435222271967db

  • SHA512

    79e382bc44eb7bf81ee3a93a6ebe71720bece8a5b79ac77736a147ce58d36c7c165a6c6e55c8131060ff2f95bea34d1330270e0bd444392890b2a236de06869a

  • SSDEEP

    49152:I0iOnygNYTF9UCDnVDC5z88nMiQLosj6vLpWHXP7F6bof:IQLYfnNoz88nQhMdWHRr

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2