Extracted

• • Target
    ead1f2fb3eed95d8781aa83be21d353d37d41719fde76705a2310d7f678cfd3a
  • Size 1.9MB
  • SHA256 ead1f2fb3eed95d8781aa83be21d353d37d41719fde76705a2310d7f678cfd3a
  • MD5 8fa2783f536f5471053ea6a6e8f2bda0
  • SHA1 c546dc1a2ae14e91ddccb224df0c5395a99e927f
  • SHA512 584c5cb3bf663bf81eec173438d31f40ad6b91633cabb298db728ebad066021e0b1956faee8a468cddbbfb366d7f6cb8ed98e3c303e6200c8d64da10145fc67e
  • SSDEEP 24576:xVaR+QZ5CzhK5/T6zw1OwBP5u3tOlXmG9Rrwllo7YyO1MbHBNb55zkqZIPM:xklDKhM5w92mGjVYyOCHZl5I
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2