Extracted

• • Target
    812d0fb85d705764903e216f5fb1027fa9b892228090b113c110954a5d01a42f
  • Size 1.8MB
  • SHA256 812d0fb85d705764903e216f5fb1027fa9b892228090b113c110954a5d01a42f
  • MD5 074c98c61cbda25d3d874993903f25c7
  • SHA1 7890e74d7541b42b495098f9f273ae8d3fb77ac5
  • SHA512 50564a5687cbd1346627b48a203e5587af47d22483424493e9ec64e1df28cd40216b6ee86dc5a6f1745f7a2f9744ed40b74760f6eea59f6f02e2a49c63e5b2ef
  • SSDEEP 49152:BSMcUVqwpN4Y96aB74/YEnmWbNS5Q98D3pP4HjbpsknH3T:BSMdVN40BUg4ppS5QEJ4Hj+qH3T
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey49e482evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2