Extracted

• • Target
    file.exe
  • Size 1.8MB
  • SHA256 67772e72ea6536254aef5687a6eec2ac0337c81698239e8fbc109b953790be76
  • MD5 b140d0e0a9bfb0c0be35c9c605d046c1
  • SHA1 f82a8c33fa2dbf8fc327be0dfd764660252d1d74
  • SHA512 f2f25b3fbe54ee18f89e825dd34ce7728873d4847e2882886a7d6f8c6dd0e0c7887263900b954abdd853935b01ecaad94a04dffad61940b402d94d859c96bf1f
  • SSDEEP 49152:6pu/+DBuLQmTEPEpEw+Lyak4YUjd0hmEQY0eBJ:3/+MsmBpEw+k+WmED
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeye76b71evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2