Extracted

• • Target

    1f88320d0292828dd497794861f30b4b67a1737dd3a3d10a26326651a529c7db

  • Size

    3.1MB

  • MD5

    c9bba08c84d4244f0235f3432ccb2368

  • SHA1

    a07e9f9f9c40dff6b7c7bf6e24a35769cd62e1ad

  • SHA256

    1f88320d0292828dd497794861f30b4b67a1737dd3a3d10a26326651a529c7db

  • SHA512

    9429c2dc0f1cd70eb95435cddfb2f21539f4490fb358b5801a736b9244224d79b2fd52146931e2d20caf4a12b3747d81d31d04e665cf9f2168bca6e473e27d03

  • SSDEEP

    49152:4PaOrSLWx4SK2zoSyRACeaEjyVWZid17XLPFfq/XBkY:4Pa9LWx4SK2zJyRACgjyqid5t6h

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2