Extracted

• • Target

    adbb64c7d278bfe2f226f450880bf082fb50f71392d4f0fcb3d9484ec7e7e6a9

  • Size

    3.1MB

  • MD5

    a8ca63853f4c09a3a327d43b59d7db7b

  • SHA1

    8a2f009e223ac17e83323406e396638fb446fb10

  • SHA256

    adbb64c7d278bfe2f226f450880bf082fb50f71392d4f0fcb3d9484ec7e7e6a9

  • SHA512

    b91ed0ac341798cc67addb8784f491e98d38147aa428fbb04d6c6c05fb7fee732910c0d1e6950edace6a455e3d04ba6dc20a91d4ffa1a4e094ef8655c34f1ac0

  • SSDEEP

    98304:k+YtoeWXwICzgBVUJO+zrADKHwkON4bfmha6z:vYto4rHwwbehT

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2