Extracted

• • Target

    5264db25838247b1d56747e7152690dbc27ee42ff91e85a15f56f5d889f13cd5

  • Size

    1.8MB

  • MD5

    ec04f77c1b0c8668633d8c5f7d56eafb

  • SHA1

    17153e4876e678d6d8a4229658f19f806b7c5fba

  • SHA256

    5264db25838247b1d56747e7152690dbc27ee42ff91e85a15f56f5d889f13cd5

  • SHA512

    228833bff03c7f683fd5b47df6f13e83e10f99b5163c1c64c0b1bf2c5f1dc9f56ed5448a2e7ba455fa9eae539f1c6a0b1827f0598f454319a7ce2fa4660eb924

  • SSDEEP

    24576:J3J1OaB2z70D5aUbPzJKYx4ZvNVRDbpTg6FPXEunf0Z/xVR2VnprLj1RUW+i19+h:lLzB2z7YjKIEff7suIHR6ZdrRc0xyK

  Score

  10^/10

  amadeyc767c0evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2