Extracted

• • Target
    5264db25838247b1d56747e7152690dbc27ee42ff91e85a15f56f5d889f13cd5
  • Size 1.8MB
  • SHA256 5264db25838247b1d56747e7152690dbc27ee42ff91e85a15f56f5d889f13cd5
  • MD5 ec04f77c1b0c8668633d8c5f7d56eafb
  • SHA1 17153e4876e678d6d8a4229658f19f806b7c5fba
  • SHA512 228833bff03c7f683fd5b47df6f13e83e10f99b5163c1c64c0b1bf2c5f1dc9f56ed5448a2e7ba455fa9eae539f1c6a0b1827f0598f454319a7ce2fa4660eb924
  • SSDEEP 24576:J3J1OaB2z70D5aUbPzJKYx4ZvNVRDbpTg6FPXEunf0Z/xVR2VnprLj1RUW+i19+h:lLzB2z7YjKIEff7suIHR6ZdrRc0xyK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyc767c0evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3