Extracted

• • Target

    ab341b06e5fc02ce48637175426d03cbab2e3d4bef9fcf6cecab16d40656c7f9

  • Size

    1.8MB

  • MD5

    e3e8cb7aa3786ccfd9e6b871996f96dc

  • SHA1

    cc56d47b5bd08819ebb21ce2509f5cab1c0cd2d3

  • SHA256

    ab341b06e5fc02ce48637175426d03cbab2e3d4bef9fcf6cecab16d40656c7f9

  • SHA512

    2fd07f97baabc019aa0507704c0ce5897fe20fa726a5aaa3a9a5bea56e689f96a693b578d6b1238d47da86274a5512f7c2a27b0e7873fa5d75e9055fd3e32c88

  • SSDEEP

    49152:IFLnqPWQLYpzIZP1Ui0R3alBiTNmhIc18S9U6VoI+6RhGiHOpMpUEKlU:IFLnqueYpMZPqhR3aFt18SforiUqL

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2