Extracted

• • Target

    4bf43326697d28d52ec08c8650ed75e8ff649bc3b1d7968b53cbc8b7ef2a202b

  • Size

    1.9MB

  • MD5

    47d1f55c26eba620566415c08b71d5aa

  • SHA1

    b4684bc4bf0b1388f21d6b1f414bbae7fbb22d18

  • SHA256

    4bf43326697d28d52ec08c8650ed75e8ff649bc3b1d7968b53cbc8b7ef2a202b

  • SHA512

    6f4c1eda7a42c54dd309e9da41a778830054051d6b3e9d014e14f1cb1315be1763add0dde6f77966205b80726014b0d9a64dcdef5e78895c650d88d4f150185d

  • SSDEEP

    49152:CSKu/JtVwHKUbT41mndiyasUW5sbQuY0mJFyG4Vj:CSKuFwimndiyasUW5ssXZJFv4N

  Score

  10^/10

  amadeye76b71evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2