Extracted

• • Target

    a3ac7a955dc3f036f392bdcb98b2929420a60f40799e3b21c6d435bd2775873b.exe

  • Size

    1.8MB

  • MD5

    7e7dd12e929d3d547cc88c21baecddc5

  • SHA1

    e93c3b3fdf2125d59978edd75a85fe3d5397fa0d

  • SHA256

    a3ac7a955dc3f036f392bdcb98b2929420a60f40799e3b21c6d435bd2775873b

  • SHA512

    37b8cf6cea4115437e1382902822cb8245dfe033be506cc4667a7e9303c5491f719f8627f62aa30bed8895cc41ef167d089d3284b5a92ca489f59087dc48889a

  • SSDEEP

    24576:e5NoFdVHL6WWmTc24Gs6MhjjVnSHL8789ss7uCAhw4IE/QLLiXFU6jSi8GJF2ppS:bdduVL24JliL87g7uCAaE/zS6V8GDU

  Score

  10^/10

  amadey0657d1discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2