Extracted

• • Target

    8fdd6e5a048925c75f0187041cee6833ceb3f4f1d0ef34405016aa81da461908

  • Size

    1.8MB

  • MD5

    ac7237bfbd3e63efa1c29bf506a5833d

  • SHA1

    1d0160a085b8aa1383cba4e6c0b789014cf3cfe6

  • SHA256

    8fdd6e5a048925c75f0187041cee6833ceb3f4f1d0ef34405016aa81da461908

  • SHA512

    a3826b72be1815fbd782d9f6b20f732339d1540f378dd95c26e34b14cd60d57e9e613361b8c20da9f9fcead0c2ce84998eeb48ee3b5addc22b9374401a4c42eb

  • SSDEEP

    24576:Q+SDM3ZxtLyy1EGw1wKO6+O3Osp8ljtbfEbuMJpd2QLXWoRu7CeE2oK:fSDMpxj1I1NZkjRfWuMJu6cGg

  Score

  10^/10

  amadey49e482evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2