Extracted

• • Target

    16d65d578328e7b79625f737360d7ec3371946a48f3e17e7afaf8e4f131904be

  • Size

    1.7MB

  • MD5

    f84e1c6e7020715931bcfb4f8448b1a9

  • SHA1

    0ae3325b01d9a92623ef501a04a4b15463757b3e

  • SHA256

    16d65d578328e7b79625f737360d7ec3371946a48f3e17e7afaf8e4f131904be

  • SHA512

    0f949cf2ecd29d1390eeb27da19861e6a8ad8b2ada0f45a9e944a2ebfc6ecadb6eb25cf1e96b6751920001df02d15a7c1b6325614d82e41d18187bf5baf42cbf

  • SSDEEP

    49152:1RrSTmOvvWYWe/fOIJ8vAT1mL8A0W21ZAo4kk26:1VSfvvfr/fOIJ8o1kfIXf4Zz

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2