Extracted

• • Target

    1a6bfde328a3fafb86fa74cac8a25393986ac0ab06f3c86e2591ec50a712da00

  • Size

    3.6MB

  • MD5

    210444e5c9bb7a0e60900251cf3836cd

  • SHA1

    6e63727ad8d97a4314bacf715045a9f845fb1f69

  • SHA256

    1a6bfde328a3fafb86fa74cac8a25393986ac0ab06f3c86e2591ec50a712da00

  • SHA512

    ac15b8d15966bdfe038ef7c7c77b9395c542e857c4bee60faed18bc52d2d5503361092aba69d455532ba158dba1eb5a2ed1b50bd696e8c8dd4cab848dd62b367

  • SSDEEP

    49152:ZxUsRjupscg5yDBwRu8s/PJEiUJU3LhmQf6JSiQD81LhHXNof+BkERCWD8X4Vijd:XUsVupscgpJgm0iVj9W+L8WDFV+Moy3o

  Score

  10^/10

  amadey4dd39ddiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2