Extracted

• • Target

    43ad090293fea7ef765086bbcc0bada4975fdf8afa8eb155d665863aa842d06a

  • Size

    1.6MB

  • MD5

    df47d994fce83c0dd101e4f4b93e4324

  • SHA1

    2be4f18a386faf34d177031dbb97ef0f46a07808

  • SHA256

    43ad090293fea7ef765086bbcc0bada4975fdf8afa8eb155d665863aa842d06a

  • SHA512

    e3733b2933d1aeca3e3c0408c059f0e6a43d8b094f2d2a125d3694cf598898648b548ccddfd11df4241406895b70f9eb1c80ed8458d61bd0463243807bf2c6f9

  • SSDEEP

    49152:qvU/FGTwxegEqJVyUKvuurqiRpicFGEOId/gNddaVtXX:qvUtS6EqJVhQtpicFPJRgZaVNX

  Score

  10^/10

  amadey18befcevasionthemidatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2