Extracted

• • Target

    83a55e22c5b5f7f5fe8e4288964fe219cf5dff1320db728796a4335233d6efd8N.exe

  • Size

    3.1MB

  • MD5

    d74ad64e699ef329cc7d1dcdc0274f50

  • SHA1

    53350efe004a426edb4157b6bd584f39ba53c8d8

  • SHA256

    83a55e22c5b5f7f5fe8e4288964fe219cf5dff1320db728796a4335233d6efd8

  • SHA512

    a7af3d21527b8c4f9697ba067983018d5bdb4cb28eb805651441b1c17136d5bc894be2be31cb0d77c0ec76b97898af70304953060a3bb7d1e76cf7e15fcdd9ed

  • SSDEEP

    49152:bTSphcq0Lrw4Gbc/RS0JvkyTdQVJuJqiWjd:b+Sq0Lc486A2vkyxlJqi

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2