Extracted

• • Target

    d7ee4d77ecce5c664aa43efa81cfc94981b1db50195ec415c4f8782322bc9fd3

  • Size

    3.1MB

  • MD5

    f8018bbe2183b62993997b8f62c299da

  • SHA1

    dad03527414a7d258cf7e3436f7d3712b80594f9

  • SHA256

    d7ee4d77ecce5c664aa43efa81cfc94981b1db50195ec415c4f8782322bc9fd3

  • SHA512

    5a5f0512046f219a471731c3e548dab7d3ddb861e302f35a9961776578a31a3ca08b27e8f728027e5c4246fe7285eceb1da553f36ebcd4d7e4d299f54692134b

  • SSDEEP

    49152:uSySqgVOLFJJZDlLWJFV+F5UG8zXaRngzfE/:uCqN5JJZDlLWJ7+UG8zqR

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2