Extracted

• • Target

    421d517434410dae2f314b59dd4fc3cd474f927ac1aec8251e0cf7443b0cec07

  • Size

    3.1MB

  • MD5

    1c62672c5209a4053ba6f8ab89024d50

  • SHA1

    15f35f53b47ccc77950b4435edeb4ef83ddd2a6c

  • SHA256

    421d517434410dae2f314b59dd4fc3cd474f927ac1aec8251e0cf7443b0cec07

  • SHA512

    1e7d513d703121c4c48ccd6a2bfa664f1824432384b0d0f8a53a70b60e58c50f9e621afc2d89f1390f79bd26f85a15e8ab4ec5bac876ee690a31440fd499686b

  • SSDEEP

    49152:5nIbQUGcL9rhRv3EpjFw1lsZkthw4b1HH45batHS:5n/cL9rhh3Eppasqthw4bNty

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2