Extracted

• • Target

    88ef088e6484da4db59d34ce7fe6e0402c46666eb8a33d09f6c345a9d2633f36

  • Size

    1.8MB

  • MD5

    df26fbbcb1de1337da90c7215eace95e

  • SHA1

    0a1872ca34a77f332d3e400c8e5271a1f5d2c876

  • SHA256

    88ef088e6484da4db59d34ce7fe6e0402c46666eb8a33d09f6c345a9d2633f36

  • SHA512

    6a217538dce465dbd5290c5598af0af87eca2a44b9788cecc3cd861e6a21f9a9c547b8d06ea7f7afc47e41b277c9f92ac0dc206dcd1671d980a1b276e2b45831

  • SSDEEP

    24576:6x28mgo43HFSA53ensgSjPut8Sdh7M5OqTbNMRFVYvvxYLnL+PsYUhSjEda9P8Xw:J8Fo43953ens+o5nTSVY0S06jXo3P

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2