Extracted

• • Target

    a4e6e73fee309c3d0479dda205af2805244cdbcd05593b8fc1b79d824aa2d60b

  • Size

    1.8MB

  • MD5

    122fad17c6aff4733e392eca0386a7b4

  • SHA1

    0be0d823262772d257a99b453d71f87fc3f255c8

  • SHA256

    a4e6e73fee309c3d0479dda205af2805244cdbcd05593b8fc1b79d824aa2d60b

  • SHA512

    dd3a8b8a699c977d6683d5a17e51826a738b64ae170ecc455ec02821eff490619b3709a10347ccf83764dad48ad392e6e43d85db772b585dad07aad24aa86153

  • SSDEEP

    24576:C2smJre8lecMoNYrFeSJ8MnkvcDmUPwQ8MIVtCUtqegEqGsw2tcGrdIeTfygjYV0:C2He0ZMoNG6H9BMIVtPo/MO8edcVQA0

  Score

  10^/10

  amadey49e482evasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1