Extracted

• • Target

    34bcf1419bbaf9e05b23e8dde63f8ef93e29d114bebab588f24c21bb40677529

  • Size

    1.9MB

  • MD5

    3cfc5e63a13d0e2bd89502915baf2945

  • SHA1

    eefef120ed21637ceb9bf3f4f3f471c43aebdf04

  • SHA256

    34bcf1419bbaf9e05b23e8dde63f8ef93e29d114bebab588f24c21bb40677529

  • SHA512

    259129f99ff1bf1d538854b982be679726c171ee620f8d2d8e70ac313b583117ae345f9e05a98f0881cca0965b6dd9e13b2e08b1d302bdb8f4cd63e04773fddc

  • SSDEEP

    49152:oJ4zEHe426erNqrh9Y0xhg41yfrVGQs9CPhzqy09we6c:CGj47YNq791yfrVGQsCpqycPX

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2