Extracted

• • Target
    67b2553f38e45e69c72859436c319d21b08ee73a106340b1292d54a4e1febd0a
  • Size 1.8MB
  • SHA256 67b2553f38e45e69c72859436c319d21b08ee73a106340b1292d54a4e1febd0a
  • MD5 220143598bf1bc72043ff3fb7ecd36b6
  • SHA1 f3ca06284621f6357aed4bd79c1b6792d4c6d59f
  • SHA512 0f6a6ebe86251fdc810ec7551d9c60b0f9c9723ea03f0b6e6d9fcdf429cb8d2e1167ad4c56d6fa16e2c7677bfddbad9824398f51b48ce5046d934ab41fbe8bfa
  • SSDEEP 49152:/oSog7eHdKTKY2lURKa0vUuQmdj1rH/g94Z7:/NjeVlUEbMuQMJX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0e6740evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2