Extracted

• • Target

    232a33f270e486c96d829546d478ca8cae2ac1ba19e8b16558a0e6e92bf4ccea

  • Size

    3.1MB

  • MD5

    e2091b8d79f58fc2d26a0dc53adf88aa

  • SHA1

    0b6b31846fbf1521cf0c82d74f1b44a20f1e7beb

  • SHA256

    232a33f270e486c96d829546d478ca8cae2ac1ba19e8b16558a0e6e92bf4ccea

  • SHA512

    353b5b35b926c187a0b2dfc81b634c27bae1f22d8cfadd83fb7f307141cadbca6f65f7403aa263bea2a356541b9afb2179de04a8015eecea3e04b47f1414285a

  • SSDEEP

    49152:ETCYD0RvSIpnI55g0YB3r+mGhJDwhhlvm1iN4cC3OSI:ETt09SIFI5a0YB3SQvmwNu/I

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2