Extracted

• • Target

    7b5468fc612c3e7fe6d424772d7dd32e674755f12d8d631d4aa43bfbb6ac8a88

  • Size

    1.6MB

  • MD5

    babf0fe9742521f4a75c539315b09560

  • SHA1

    26b23b0e062b500483f6610c3df7620e89e16004

  • SHA256

    7b5468fc612c3e7fe6d424772d7dd32e674755f12d8d631d4aa43bfbb6ac8a88

  • SHA512

    65e4f634ae169b48b22bea344313375075e71855fa6f676622537315b02d73286b3de372fbd64056bf59971c10af5c0fb56a365842003de4b3d647dab98f2652

  • SSDEEP

    49152:USMjUUtZa4cKG4T4dOtoWw/bX+4dfjfydqHVZe9Q:US2UUtS948dTj7+4dra+Ze9Q

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2