Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    863f6e719058feed00201f407e1b5a7d7d26e3d912670078583bb4e9d320bed3.exe

  • Size

    1.8MB

  • MD5

    b647137c15b5964746d800f149c771ba

  • SHA1

    56cf6a851d0e4fdb5bba59365b7bb9ca7875e0ea

  • SHA256

    863f6e719058feed00201f407e1b5a7d7d26e3d912670078583bb4e9d320bed3

  • SHA512

    db9e3ba8d7f0468727edabd3b7ffd731c5c92ef5c6ad028c43b94475329b50d12b0c4f30ec0f46fb703543803b8c96d47150854888df11b43efa4d3c0f3a50ff

  • SSDEEP

    49152:oFBSXMHHF5rlTSZc4Zc5rPXnoCJImdAFqyAZ0U:oFBSXMFdlT1iwrPXnRImdKpW0U

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojanexecution

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • UAC bypass

    evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2