Extracted

• • Target

    ffe651949e62cd041dee9b18e715b27dc5faeb8a27a3096a8ee5d8344199f072

  • Size

    1.8MB

  • MD5

    2fb6622fc2bfdf27e27c8bd33c2ba196

  • SHA1

    96c0797818d02bc373fa96e8d42cae66e41d51a4

  • SHA256

    ffe651949e62cd041dee9b18e715b27dc5faeb8a27a3096a8ee5d8344199f072

  • SHA512

    bc68c80791e6380335c3741cc2001fd5fcb19d62aec9a618a979cb0b8e7671f428e60252814e4f9a1b41768f10afaec83419b720924a3add6bb04fa295d36cf4

  • SSDEEP

    24576:R/fha8JVKPJI852wYgvNwhIYPX01CrYPB/4BSfQ/2Lor0h+1SHp863LZ74e8lV3Z:ZbI5egvDYPErPB/DLCSSsqecStWJ

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2