Extracted

• • Target

    5d64b7ceda882bda0e8c8384f2edb0668d84b6ddd79ca5d75ca280f761a7cbde

  • Size

    3.1MB

  • MD5

    37083b063fb068c71cc025f842d985a1

  • SHA1

    47480faa3a194905f0d5ccd8e0dbe7f50e1884b8

  • SHA256

    5d64b7ceda882bda0e8c8384f2edb0668d84b6ddd79ca5d75ca280f761a7cbde

  • SHA512

    e74c780123afdece31831bef687bbb3c809ac5406f500341ce3c65f1ebc8263424729cf3499eea773492c1b6e3b389d3292b3de0184720892c7a5508c676856e

  • SSDEEP

    24576:HsTrFLIsP1z3MnTblzQt/2LzE3Fe6CHrUgxEnKz1OyuaFy0idLsG3f1gp7dLwKTR:HsTiW14T3E7WxErzqpKGu/zorjIAg

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2