Extracted

• • Target

    762cae72ac8e7885099f1ae215b4ac7dfc84affeb01f8e0c13bcf8335d76e189

  • Size

    3.1MB

  • MD5

    41457204ede475588f11055f18d45750

  • SHA1

    ec6d2e503618f4f12beb6ef7acfdd35a83c836a9

  • SHA256

    762cae72ac8e7885099f1ae215b4ac7dfc84affeb01f8e0c13bcf8335d76e189

  • SHA512

    d5497d881de55ef90bf998394d89c8e4a5436a477268ce6b58a558054ca2cdb6c431eb4eea4b90f867deba3577901bfb0877132cd232feff8b8c97da208e5fc0

  • SSDEEP

    49152:4sef34s6HqkR2LIKop0/ig5E4PL6x/j1TK0VSpeci1+W:4xf34s6KQ2LIKo+/ig51PLQTKim3i8W

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2