Extracted

• • Target

    345ac5c010fdb40daa99bce729a16a3e69ce4e47131ea74af2428177114f109c

  • Size

    1.7MB

  • MD5

    d2407c83e06990d094b2a5963c48830a

  • SHA1

    00a3e8b4722f185f2743eb394e5c84f07553300a

  • SHA256

    345ac5c010fdb40daa99bce729a16a3e69ce4e47131ea74af2428177114f109c

  • SHA512

    e5b2a786748dffeaaf58681d594f7a872846668fc268c637a8a1285e7fc83f78fb6d379a5d843257b7e892cddbf1ec1aad6d64abcfb27851e3c4759564eeb210

  • SSDEEP

    49152:Y4tw5LMc4mgD8y7TTV3voc5u++PTQBXQvQ4iflpiXhywMs:JtQLMc4HD8igcYXPEBAvQ4iflpE4Hs

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2