Extracted

• • Target

    eb272e703ffdca2f9140519b8d09f69a9e8cc3bc456a5762f094b7c7de331d40

  • Size

    3.1MB

  • MD5

    3afd40dc55476aaa98f2aadb6d3dcc41

  • SHA1

    867d3ba02cd018bf2365f269784f6bf66126ba8b

  • SHA256

    eb272e703ffdca2f9140519b8d09f69a9e8cc3bc456a5762f094b7c7de331d40

  • SHA512

    7f2aa3c8cff5bd4a232c735d17e40a7f3babc558cf5884c6b09cbeadbb873b64ec7b03d8fecb03139febc583b2d2949e350550657fd84f7ec32dde2a8420f307

  • SSDEEP

    49152:xrazR+Fyc22VzZ1ZJkzYBP299IlPoCX5Kews+A6qn2UiNvaeYn:hazUFyctDZJkqP299Il9Kews+A7Wvo

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2