Extracted

• • Target

    f267abb5b184dcfc91a6e9aac7e2fe4c490142292b442814494635d38b179a1c

  • Size

    3.1MB

  • MD5

    5bcf3e5f5192a077f237f7c9580e6fe0

  • SHA1

    cec8a3f915bde5b7ff646b48433976f288e5caf2

  • SHA256

    f267abb5b184dcfc91a6e9aac7e2fe4c490142292b442814494635d38b179a1c

  • SHA512

    6f55d4b20573fb4e3dbb634a935c4350b63ab77e2b29d48e672069695dd15aa620217a1d1967dc91cf920f22f7a295d4dc60e61769c09e9ee2b6f371bcc6dbb6

  • SSDEEP

    49152:7RDDiibpR0V3oBgAqoTM705uSnr6WAlrynPX+nWqjrD/:7RDxP0VYBgt6SI5nrBEo/+nWqj/

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2