Extracted

• • Target

    9b428357147e9b84f035527c1308870147a2930027e20531df19429545f06421

  • Size

    1.8MB

  • MD5

    fa6419e8f5a6bee481357f2a1f40efeb

  • SHA1

    666ca974b3918ca19323fe9813a14cb4790f028f

  • SHA256

    9b428357147e9b84f035527c1308870147a2930027e20531df19429545f06421

  • SHA512

    862feebede8863728cc3d34b48c0d3acea31279e96c39957a8b4e84f7d771ce65c7620a6fbeb80dd2e8c0bc9d6117e8d6ac63afeac3d0d0b89e28a48e1dc5dfa

  • SSDEEP

    49152:3/1G+rnmxTDSNCpLm3AThjsWq4YYFreG:Po+rnmxTDSYpLhj9ZeG

  Score

  10^/10

  amadey4dd39devasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2