Extracted

• • Target

    42778d41dcb782755ab5727789eebfba9eaf995cbf07ed3a28df24c9f6f2cd2f

  • Size

    3.1MB

  • MD5

    5376637d53b18f39c49b52a247a2c7f5

  • SHA1

    a9f77983c0e0b0e956562e579cb5232a73ef18d4

  • SHA256

    42778d41dcb782755ab5727789eebfba9eaf995cbf07ed3a28df24c9f6f2cd2f

  • SHA512

    83a744f33f2e37c13f8064cf865aa84326e83740dd4a07b2be809b5f8c77a2b79b2290f0afb2abfe970832e1024a283e22b80cb3bf4145f20d2753e39e304c4f

  • SSDEEP

    49152:3tTDXeAax3E6RnjQeYC+xD0V7DN025c84/uIN9To:9Xuvx3E6RnjQeYClV7Dh5fzIN1

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2