Extracted

• • Target

    ade52f8eb40f36f032b612cbc663db664006db096607da2a506aad0a9fcfd3ba

  • Size

    1.8MB

  • MD5

    693a5133f437df45bc838decc20850c0

  • SHA1

    3a10b3a1b3a923a04eff71fcefd5e89f0d78ed45

  • SHA256

    ade52f8eb40f36f032b612cbc663db664006db096607da2a506aad0a9fcfd3ba

  • SHA512

    bcc489ee9a86c827e996e18d95991afd698accfbd34711700b05a1849a5ed0159c8b53ead4c1d1952c4c0b3156da1944feb0c967b2b983fcee1118387f34e11a

  • SSDEEP

    49152:Bho+WMRwob0FiIZ07n9x6+9zi9Qfv6Fk6t:Bho+Vq2ZD6j

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2