Extracted

• • Target

    ae686d84a3e783d22ac65c1aeea7952cc9a9ec11b27fb950d45168ede935f22f

  • Size

    1.8MB

  • MD5

    2d53b46df08693019a8c4a4edea68ba6

  • SHA1

    055e26a017c23be2c2b71ece9bfb96bbf8ba5186

  • SHA256

    ae686d84a3e783d22ac65c1aeea7952cc9a9ec11b27fb950d45168ede935f22f

  • SHA512

    849d029c786f74a61a5fa4be23ca27d89e0e56c08a1bc9e569c93fecd533a5e411014e5a220392256e777fa32212b3a2b8aa4b3625423e1fedefb72f7f3e339d

  • SSDEEP

    49152:+T1jugBYJPe0ZdJdsOvtakDqBAd9JuKPztw:+TlugCsUdJZtakemcK

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2