Extracted

• • Target

    082172a1ac408514db209be6e6d0f2d14359acaf384cf639267c50f7031261df

  • Size

    1.8MB

  • MD5

    649d4777d6a02093d37236f4d092b28f

  • SHA1

    2bdca7a84333d9fa3b411aa40daf3d2a49b8bb03

  • SHA256

    082172a1ac408514db209be6e6d0f2d14359acaf384cf639267c50f7031261df

  • SHA512

    a906d3291f297d7d653c8188f80a882833a00098527653b13b165fe0f267cc35477425decb5e17ad431f1d32060418c371114c56a243f070541c39192ed50da7

  • SSDEEP

    24576:4xqgTgNCb/l4ZrkOcPEjjRDwagBtdDsSne/lcapZXZqRuYoiZeKnM2lKD:4YgTOCer9/vgBt+TJqUYvZ2P

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2