Extracted

• • Target

    f8976e7568c5a44b6f11eace4422ec004f364dced60b2dbd1595ea2833aee1cd

  • Size

    3.1MB

  • MD5

    75a81cd53dc4f5b69d543b5927443c91

  • SHA1

    a5e696563171aa1ce97675ed24bb7e19ac2da082

  • SHA256

    f8976e7568c5a44b6f11eace4422ec004f364dced60b2dbd1595ea2833aee1cd

  • SHA512

    257b75e796c01de2afc8a621e16ff7319f36a6f73d182534b69dd99a75c099578e955f64dce0d0ad1254d2234a90e497b5fa0866b8e7fdfc38facb0995210820

  • SSDEEP

    49152:QRkVLx2Y+vBQI5SSv59KmMLSWZwriU59e4byTx1UbF3bVnefL6v:QiyY+pR5SSvPKmMLSWZwrXIxebD

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2