Extracted

• • Target
    08085ffbceb2db75e037624ed5329b96932913dffdac4f4f592ecee4f18d945e
  • Size 1.9MB
  • SHA256 08085ffbceb2db75e037624ed5329b96932913dffdac4f4f592ecee4f18d945e
  • MD5 f739e09c9647d0fb9b70678646ee45b3
  • SHA1 b0dcdcd999183c053adccd84a9b5efd62f1f5bd6
  • SHA512 884b4e838b19a2c1581f8dd41fbe25d49e4a68fd7fd1c32341e4bf332c5d93aa2b4d00aa936464f729301b51eef167bbfb2c7f53fd5ba93797a0ed6794922f1b
  • SSDEEP 49152:23oWmljJ8Vb2QKBvj6NC8bLGhRoTVJG3Y9H71:2nmlmViQyvgC8OhRaG3KH7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyc7817ddiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2