Extracted

• • Target

    564791c950ba5f5685184e5db2a130ed8aa3f7e6a4a01fa6252c6ee993f3a249

  • Size

    1.8MB

  • MD5

    f11c507c4a22d5c741d52ac6808cc4fa

  • SHA1

    77686b60f24c97f025a70eb52f055025816cd0f0

  • SHA256

    564791c950ba5f5685184e5db2a130ed8aa3f7e6a4a01fa6252c6ee993f3a249

  • SHA512

    e17d923d2cf6cee8b7c26677b2cf653e30e09be23ab78cb229f2cb9a14b0d893335d433096ce75d3a39a311a218e3cc02059cc77746b29cfaf48dda5b4829509

  • SSDEEP

    49152:1TYAVKkA08bbbMAAZi8sbD5T6Yrj1Eud6qk2Esh:1TYAVKkK9L8sbD5T6y2ud6kh

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2