Extracted

• • Target

    a64f992363e6b29322c3f0eaae409ce8c4cc42044abb2ee82667a4e026503e16.exe

  • Size

    3.1MB

  • MD5

    5060cafcc964bd8f5952e002efb67d46

  • SHA1

    897f2f6a0ffc81ea3fa812ad916695cf2e9e7f1c

  • SHA256

    a64f992363e6b29322c3f0eaae409ce8c4cc42044abb2ee82667a4e026503e16

  • SHA512

    a61596ccf7bedb9050d15eb39ca8ae68f29070f3e2a2488dfc91cb30cefd9ba93c0ceb7c97bcff3875b40293b6f1f06377791f369d110902d50d5affb6b46ca9

  • SSDEEP

    49152:Xzaozin2JQXMQ4utxrM2K20bZVel4fh15hefZnmlZ:1in2JQXV4utZM2K20fel4515wfZmlZ

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2