Extracted

• • Target

    09744c72b94eff7cd7e6862a3ae60f55f7eb9b7fa6a9e19f2ac8e6956d7d3e82

  • Size

    1.8MB

  • MD5

    864af8e0b8ac4692283a1d8e26a2ae2f

  • SHA1

    50bfa531cc346e1f58d92912667b5171528d814a

  • SHA256

    09744c72b94eff7cd7e6862a3ae60f55f7eb9b7fa6a9e19f2ac8e6956d7d3e82

  • SHA512

    d3d394a94f58a8d44b3e98f9536ff1ff7d551d30cf7bf04c5fe5500b2a2ba13b8251feb439c21f605f5249c33f25f7a05d2310c06612ac73aa5707d49c4eaa21

  • SSDEEP

    49152:ze5z8rTjoq9DSmiO4JPaZi844OHjRlWxzGuur:ez8rg4DSFSZi+WjRlWl

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2