Extracted

• • Target

    23fa67dae3581b07f20cd23ed910a6227fb775fad578d83545ccd4aae4a0b3b6

  • Size

    3.1MB

  • MD5

    61775ecf18376d9ae135273b6f2e6aee

  • SHA1

    1be27a9f3ea1f86e11555ad4a9b37745ced3c5e5

  • SHA256

    23fa67dae3581b07f20cd23ed910a6227fb775fad578d83545ccd4aae4a0b3b6

  • SHA512

    e6d633779bbdc3f4be33b572578c176d6f49afa2bd20f7189ff0c59980831530b9ac7c01d51f4025030fd59a8dcd553f365ac3927f76123811a6965a35272ca7

  • SSDEEP

    49152:hG7Fjqh4Da9ndRCqsJMYRGWjaepBGo2ldk5ff:huFjqh4u9ndRCqsJMiGWjxPGoCk5n

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2