Extracted

• • Target

    dd4f3e4fec12e5241581b5e7f96472e7093625ed3b6f4bb38208b37c82da55d1

  • Size

    3.1MB

  • MD5

    580d3dfd202a3330c102622c19ea9f49

  • SHA1

    a80fa8c600b299421142715513ea2527803cd608

  • SHA256

    dd4f3e4fec12e5241581b5e7f96472e7093625ed3b6f4bb38208b37c82da55d1

  • SHA512

    519a7a6896ecdd8a8214a107e4fe43c2936989d57e4470dac32a8cd3871c5a212dc857ba967232c1953e07245913ce32acd182765ccb98dc13c3054ffa2b9c1f

  • SSDEEP

    49152:srla0wryaJgzUUuGdI1ViMr8rtigei2Km3G46WYp/IarNu6s:kaJgzUUugIv5ohqi2Km3G46LpQaB5

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2