Extracted

• • Target

    ed44eacaf6c46a0ff8af808ab4fdde03a12694af00f1c6adbf17e9577bea44ba

  • Size

    3.1MB

  • MD5

    a5be1bf850edb57c6cb6f9c07e87d2b5

  • SHA1

    0be4b98930608e9cc879ab0f841073b2896e82f4

  • SHA256

    ed44eacaf6c46a0ff8af808ab4fdde03a12694af00f1c6adbf17e9577bea44ba

  • SHA512

    d595284d556103d477f0a3c97d4f76a7702c7e8de81b03a9fdce50e8b191055f16ec046c7b7d5b6af7a1b830ed4ff3f669305f54c08eeca7c29ba1c640766344

  • SSDEEP

    49152:cGDEGA+D38SjWpBzZG4kTdZFmZRuDfpwunD7dWRJTsrXR:cGDT8SjW3F3kTdZQ2mG7MRi

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2