Extracted

• • Target

    ceff378ba455ba298b382da33c44243ea47d672edf2c8cf59347f646bd70ca68

  • Size

    3.2MB

  • MD5

    4614056155a78b787c059535bb1c4ec3

  • SHA1

    77987e3421346285490439a98421c06610c8bddb

  • SHA256

    ceff378ba455ba298b382da33c44243ea47d672edf2c8cf59347f646bd70ca68

  • SHA512

    1347bdb1e69303c3bdca534bbb4956eff1f64b259bf587b95b3678cb02946b01c64b6f6ce782b28bee1410c07ef73eeef65bb9f79f719330e3ba6ceac24526bd

  • SSDEEP

    24576:OIwvncUa/p8o9jd56CW8WIT9THFHSL0UrES/HDwl8IOE9o2tCnLwiiwdevD6WG//:SvHC3h1N5spetl1OCIvPe4zzH

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2