Extracted

• • Target

    ec8d6218d06e846efc6a98b68c62fc976853a52cfacfb010099bf7d9eccd2bed

  • Size

    3.1MB

  • MD5

    fe13a91e958ff1e964877edaac5b06b0

  • SHA1

    93c1c32b399708f0b769b618e839ca7aa368cc2a

  • SHA256

    ec8d6218d06e846efc6a98b68c62fc976853a52cfacfb010099bf7d9eccd2bed

  • SHA512

    924fd3bf884c9288fa58cc333db8af834ce5ea4b14458b88ad71ceaa7820841e6cd49a027d1c09d97f407fba22532290130065ed3cb8260771fa00a085e73058

  • SSDEEP

    49152:ARKUrNJS+b2l+a9URuUKuf4Erm5tn6X8GsePsAaejzM:+KUBJS+b2l+a9TUKuf4Ea51iuePsABn

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2