Extracted

• • Target
    291a8d56e77cb07be1a6b4308d51650b.exe
  • Size 1.8MB
  • SHA256 fda0fc105ffd6faae12d08c243fe684be8c69696bd654d733f5caf487b59baae
  • MD5 291a8d56e77cb07be1a6b4308d51650b
  • SHA1 310e47b223740de2989f5c8f4b12d294e6568a2c
  • SHA512 7f764a84720ddd1b2792747797befb2272eb33dc4ce141c78bef87356e7c861451588678e2a041084db3b96a8a23b191d864f93e66f8ffefe368fbb494f0165d
  • SSDEEP 49152:N4T6hIyXZjUqy6rCPkriwTB3/4z/vVaHAZT:+T6hI9DQi64z/vs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0657d1discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2