Extracted

• • Target

    19ca455c5841f687a55b5bb57d308047386e1ac9258e099e73652aa1339ac95c

  • Size

    1.8MB

  • MD5

    b2c8aa7027bcb5f22e460f8141bd87b2

  • SHA1

    9af49e32560d653e85a8ed19c48d0098a457479e

  • SHA256

    19ca455c5841f687a55b5bb57d308047386e1ac9258e099e73652aa1339ac95c

  • SHA512

    6ef2602bd9c51b62ceb2967a683d7eeafe6cdb9b954a5e48532125cd419dc1531a9dbe0fba705c8df388b0f220f3754f1e1a7008b43eac3b14e94fe1f0d15390

  • SSDEEP

    49152:grXYkCo8QNhDGY4z+EwZ+55SO4NEwScb5cXJ4:uCwhqnahgD4qwSQcS

  Score

  10^/10

  amadeyc767c0evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2