Extracted

• • Target

    4b88d4360a5df6cba062e5e738d0e66ad7f2d1b3e943c4c992dce08569f40ab8

  • Size

    1.8MB

  • MD5

    90b13da32a4d8d49aa3ee3609dbb4049

  • SHA1

    aafa445887d1a8d31cefe9ad870d213477df205b

  • SHA256

    4b88d4360a5df6cba062e5e738d0e66ad7f2d1b3e943c4c992dce08569f40ab8

  • SHA512

    b8a8366de7943a7b5ab8f13191707e461bed45a330a0fe51f7f450816d7e0e4154d5643c697758af1781f39f83103e400ee0e8bc3f3bab366454e39388f4a3d9

  • SSDEEP

    49152:gWJlI0V69UzJ4XwIGRHaevyMz5ReF2jn4ZLmBMemzHvx:gWGezi8UeaM7IEq

  Score

  10^/10

  amadey49e482evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2