Extracted

• • Target

    ea2f0bd2d44e5a96c6bf54be7187c2a275539ddb9cd2adcce0de7734112c4d3b

  • Size

    3.1MB

  • MD5

    cd47ed2ed737ab67df664138c8bb8580

  • SHA1

    9aed2864aadf664b9e633385fc8cdba959c79c6e

  • SHA256

    ea2f0bd2d44e5a96c6bf54be7187c2a275539ddb9cd2adcce0de7734112c4d3b

  • SHA512

    a59b677559e192475b0b0a9213b385f3779c6943150e714e7a729545a49899c87f02800cc21e8d13395c0fb5686416007adb3ba913642b9cf4bad98e9864ba01

  • SSDEEP

    24576:tN7Wlr4V2o2Uy+J0A+kePldM4fVpiIM3GJ6zLtFNWpEhSg0o0V6ENFv3n9KYhsa:sf+STkw/lszhSEKNFJMqj/DuChd

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2