Extracted

• • Target

    91e186c17751b8b47fb0697208e44ddb45ddf88d64d90d94209dc6dcb1107b5bN.exe

  • Size

    1.8MB

  • MD5

    18053a51a28d8ee4c57c483d8768db80

  • SHA1

    4a2bd73285c64cd3996338b2574d4700c8cd1b21

  • SHA256

    91e186c17751b8b47fb0697208e44ddb45ddf88d64d90d94209dc6dcb1107b5b

  • SHA512

    30f226a3bc54306159376372382051c4f06c98cb6f06096ea8c7805f13257c32ca721f9f29523db94a9affbab5851283b050bc18212900b4983774e7e8a9b048

  • SSDEEP

    49152:tmV7CcMK8zKOenIzuP9eyz/x3Pept1cku:kEcMK8e/Iq1eS/x/4t1Lu

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2