Extracted

• • Target

    6032b6c82d9293195aa02155abef80ff0734d866a27eb06fae9e973ebac26b23

  • Size

    3.1MB

  • MD5

    571b42d95398fa63402d5d63de1c488b

  • SHA1

    0cbef86c1c3b43c643cfcf015c0ba71a0bdfe6d9

  • SHA256

    6032b6c82d9293195aa02155abef80ff0734d866a27eb06fae9e973ebac26b23

  • SHA512

    02322d83651e252008095fedf8a48c7cd10942e821c226ac894eae8cc9522d4d4dea76b72cd9354e5a400745383996144da524a37a3025e540db7efefb9c94c8

  • SSDEEP

    49152:++Ow49wnFWNbGntBZYlMt4+fMuj0if3ZSbbTK35Fx6OmH:FOZItBulMK+fMuvf3Zx5Fxx

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2