Extracted

• • Target

    ecd419e3037faa87f3aac821cc6d5d704d601bd981028fbfd5df3546b5ae7b79

  • Size

    3.1MB

  • MD5

    d401821eda995331522c6fd021d84573

  • SHA1

    e93a323eac3d036955bf564aab33f8cac71a1de1

  • SHA256

    ecd419e3037faa87f3aac821cc6d5d704d601bd981028fbfd5df3546b5ae7b79

  • SHA512

    4c7bb28d2ccbb977040dadbd3bff500ac1f52155e141865f6483e5e1ef5bbd842f44aa407274ff5c02dec666e2c693c99f42c60134322de17050a964cd50fdd1

  • SSDEEP

    49152:9AmkGMnOonQDN34EBcjpu2eLu60+Dt6RX:5enOonQDN34gc9TeLz0+D

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2