Extracted

• • Target
    b4ef618422c5c4f681a9bc1852cb04f03247bf9f86f1c6095f8485fdffde3390
  • Size 1.8MB
  • SHA256 b4ef618422c5c4f681a9bc1852cb04f03247bf9f86f1c6095f8485fdffde3390
  • MD5 f2aef3b38d91c72afb681c5eded18a85
  • SHA1 71a95ce0e1444c932aa36ddabfbe97e7acac439b
  • SHA512 39ef4596b7b56a3109f0194d35357c47a120a1a9710233b7b88424ffffb139ac9c5f9926c2f8efa1055ddb49af0bc9d52ca931f68c0209c3295d0c90899155d3
  • SSDEEP 49152:Uj+xjXrmwxbqEFw8cOYMipy9A/EGvvXSqsB9kUAqLLK:Uj+xfmyHbdik943iqsXAyK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0e6740evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2