Extracted

• • Target

    ae87b6178112a33783ad832f7ed01b3543a53b201372e1b9ae350cca73b9b857

  • Size

    1.6MB

  • MD5

    3e998278d93e45e1b586428f825920d4

  • SHA1

    2f4e5a9b6692d24ce4b8832e64ee9fe94e61663f

  • SHA256

    ae87b6178112a33783ad832f7ed01b3543a53b201372e1b9ae350cca73b9b857

  • SHA512

    e3f143ea0fadc62a5f00e805b56ef31afb62cdfafbf839fa821215bf6d04a943ab59650d288bddb92984b6dac6f0fe9e0039d531e241e0bd0eba5b2d1874d961

  • SSDEEP

    49152:pAXzyXx9dnz6sDUmrenD8pzB4KbyUvkow8Sqma6K6:gWxPz68Um5zBBbtw8tB6

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2