Extracted

• • Target

    51932f76bffcc9360458dd3d1e9b3c29a606571168aa367702b74358d762fb6e

  • Size

    3.1MB

  • MD5

    1ab42edab7c4a33d1bef474db280bead

  • SHA1

    da81156d76af49bc77930868cab7800c142289c3

  • SHA256

    51932f76bffcc9360458dd3d1e9b3c29a606571168aa367702b74358d762fb6e

  • SHA512

    e1ee145d7b3b65a3a8c5ed11dd0f72a3e51542ea62a1b71ea5ae6915dc3ec5584ee8d62a6c87d5f404bfa70da6feeaf1ca52b4881bb5415eabe060d6c7be959a

  • SSDEEP

    24576:c4RoUxFN870HvX/HXk5rUWfv6b68f9yrFR5jBVdgoEx1zwC6mlMb/GClRjtCEACD:lpx8S3+nBBiGYCRh7d6I9k4h8H3fyss

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2