Extracted

• • Target

    d95b98340bfffffd579203e0940d838e7313217eae8863fb65aa9a9bfc3bc359

  • Size

    3.1MB

  • MD5

    7fd62d2b511c537a48f93291e41b019a

  • SHA1

    7c97f7c15d2aedb5ab3fa0c4c226dd87bad79e79

  • SHA256

    d95b98340bfffffd579203e0940d838e7313217eae8863fb65aa9a9bfc3bc359

  • SHA512

    0febc1a23a57ea16a0d51b20effe455968b3e017266918373750fe0ba95e924f69cd2205f402d39fd6df2828ee335a4924b9267a4178522df78949c8309158f5

  • SSDEEP

    98304:HFqN0dl437vTZDToorg7n8JdQB+BxA0brAkZ/S31QW:HFqN0dl437vTZDTo7882cs/S3

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2