Extracted

• • Target

    e5fb469fc3f4dbb4ba3848e468c2e203c858968804f7ef95f26d97529a129390

  • Size

    1.8MB

  • MD5

    7f2fb8e5d9098560ebcdd46e426b4a35

  • SHA1

    c9194f022e28efc6d68e6c433638d17e9ca6a26a

  • SHA256

    e5fb469fc3f4dbb4ba3848e468c2e203c858968804f7ef95f26d97529a129390

  • SHA512

    0b9039a1dcc8291262b02e10b03bb2a5e30b2efd2690e264b638ac64108f17e17fc70f37b6aa752d7622d3664f5cbee2116ecaa32af409a88ce65803132fb380

  • SSDEEP

    49152:/8YuB97L96YunVaEsgCoJsI7A8DOCgsl8IVqHe:MB9396jnVQ/Z85fVqHe

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2