Extracted

• • Target

    d2a41394da3c958eeecd0c43a72e5c401fd5209e462b0035bd1ba5dd9b4a6b46

  • Size

    3.1MB

  • MD5

    d297f9f22080c6f66b4e9c9156a6ff86

  • SHA1

    bef0f2e329d9db6bafe18b63482545b79b3d3c47

  • SHA256

    d2a41394da3c958eeecd0c43a72e5c401fd5209e462b0035bd1ba5dd9b4a6b46

  • SHA512

    4fc5d9229c3174fb76947190458d56ff76133f286295ab4ce439e64dcc5db5d0289c734eb4c7ee49db7636cb2e9b22649009c7b7f920806d327710bf2618bb94

  • SSDEEP

    49152:ihw05uwGDAu9kS8AmainjRha/nxaIYd1s6l8ua3yflGAM:ovu9kS8AmainjLgn4LM6l8t3QLM

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2