Extracted

• • Target

    amadka.exe

  • Size

    1.8MB

  • MD5

    58822ff9bc27d6e054df82b7aa85d5ae

  • SHA1

    d2aa1da9401958ed87cde2b07d81572ca6f74282

  • SHA256

    714808863f8d77d2d38353efd9ee3b9e158884cc305d10f42232a1aec3e537f1

  • SHA512

    c3261459b460c744158d72e8ea008a6a161bdd53b182ac81571ac37b14cb8aad5a7bcb7bf9928a3c20354e6b142d85167f6484071d3a1d3cff6de193fbb933f7

  • SSDEEP

    24576:SXi6zsNwpZUZKIAVkRqdh0frIGE5Ddv3BitAgwssWDBFdq0bNkdIAM/P1381TnH:SS7QZUuxhY4EtBjDBC0bNeIAMVspH

  Score

  10^/10

  amadey0e6740evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2