Extracted

• • Target

    1472c12ac3757a46bbffbe2abaedf589aeb37182c2138a6ee8e2e1fc655b63e1

  • Size

    1.7MB

  • MD5

    aae4629d8437f2605900341f92491048

  • SHA1

    ea76eed227f4e97ca1e3f8504880b69b239807e5

  • SHA256

    1472c12ac3757a46bbffbe2abaedf589aeb37182c2138a6ee8e2e1fc655b63e1

  • SHA512

    3d4fa487b28282f4c7c6107cf79e2c0a5996d5ab5613f6a369a73b3a1ee053b6a20cb6a6212621e3a171786e89742e4fc61b81c2f4e81472decef7164ba4de4a

  • SSDEEP

    49152:axA8A+obluygb5OLY/vK23dMmiRybET8Ar:X8AdvIu6V3CybE4e

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2