Extracted

• • Target

    7e3f4addd4c62ae1a2f9aa96c4f38993817c1299500af0ac75a500c42a05c3c0

  • Size

    2.9MB

  • MD5

    375e153f654df2bfdb976c882b45f7ee

  • SHA1

    3cfb6520e5738940933a67b55c604342f9524cac

  • SHA256

    7e3f4addd4c62ae1a2f9aa96c4f38993817c1299500af0ac75a500c42a05c3c0

  • SHA512

    7256dca53420886d81863fc80d5aa4cb3b6d97f089d3f43ea55b12cbb52608533c26a7b38edd2deb5a191ad06aa26ef9f563f6b48f3722d5c875646a9f4de2d5

  • SSDEEP

    49152:cNhhKC1DLsZ9d7L1GjQyptUw9+4auCYjAuLd:cNhh/VLGJd4atkA+

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2