Extracted

• • Target
    59355cf275435ce5ca86700202c32e7cfa1a850b11686374638982c686f63dd8
  • Size 1.8MB
  • SHA256 59355cf275435ce5ca86700202c32e7cfa1a850b11686374638982c686f63dd8
  • MD5 38422b4a0e4f63387e765fc556b3f99d
  • SHA1 597c8cd23d9578addab79dce2a87db05797b486f
  • SHA512 a643617c06da7938a307c89aa64da12e75cfa35a324e0f38d893bebcbef505fbd51889aec7ff43be53ca064d87b1f1660a624951efeb9c124c7661b6db63ca41
  • SSDEEP 49152:+qqZtVD6ApSynh538lwLPfTyg7guhSH6KlnBC:w7Rr38e+g7yaEnB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0e6740evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2