Extracted

• • Target

    e4113096c2753afdfb662683c6268ff9952b98391fc667a1f29643881b31d57d

  • Size

    3.1MB

  • MD5

    1c9d354a6276792c60cab75774487612

  • SHA1

    1830cee66997a789d321c29227bb6c1a18d59a99

  • SHA256

    e4113096c2753afdfb662683c6268ff9952b98391fc667a1f29643881b31d57d

  • SHA512

    357319978d6390f23d38a724f4a6136fdc34c84cbd04a2e9c84b1180b3dd935c815f317e58e70481d40eb9d910fe7a456d17de4083f14a7e2aa9f2eb5e996962

  • SSDEEP

    49152:fdZLG9bwi2cTvmktCbs17po8axAIzaig4F5j1pDq7XvJ:fdJG98ijvJtCbs17e8oAIzawbp6XvJ

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2