Extracted

• • Target

    10288c0992d5b2197079befa1efa537d3b24266af689cbf36a5f2e0194f36828

  • Size

    3.1MB

  • MD5

    0c333982a03dfe29b6151bb436359e94

  • SHA1

    5acba09214daf8aa1e8b5dd602f6dde017e8d5cc

  • SHA256

    10288c0992d5b2197079befa1efa537d3b24266af689cbf36a5f2e0194f36828

  • SHA512

    af404e231a2c0e9013c82bd557ae31a4b6cb0123b9d5fca22638d8279bfa55c25f45673e99b44b56293001b507ce8b986a73c4cb9d6b7b5ddca9f08df9a636e4

  • SSDEEP

    98304:bMn7IIZ4nzfyUIOtGOCCsBQxr+ecUylx2:on7muTbBkrXcUylx2

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2