Extracted

• • Target
    7dbe77fe18f5636df2fc5869e40c38de100123273ae464c9929bd1f57704f969
  • Size 1.8MB
  • SHA256 7dbe77fe18f5636df2fc5869e40c38de100123273ae464c9929bd1f57704f969
  • MD5 ffc05e2526d75156dedfc82180de5d20
  • SHA1 57acc1b3d60803aacb726124a6f5ad5fdd0b13a2
  • SHA512 bf6a99d9241d07f42ded9627b2f328b36b675d8c398ac86bac9cc6b886b7f6a0bb816d888506af16cb3742605a1c422ede2141415c0fdc54f8ddf9f988d13de5
  • SSDEEP 49152:3kKaCYXUrE7BJ2553LPpB5I+ymtxl4yQRPRXq6sOXjQ5:323krE7BJ2r7P9v9x8pXXRzQ5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0e6740evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2