Extracted

• • Target

    file.exe

  • Size

    3.1MB

  • MD5

    38560b590890a37ab8460092560d282c

  • SHA1

    2564dac98b8ed26fccaed9764f172c9123e50f2b

  • SHA256

    014857e05f8c8abace4ccf74a6e613a755a651d724c510dc5959bea75295f53b

  • SHA512

    5a5b0869092b690ac373d03916142c454d88fcb7abd26ceebe738e2df1d09416f19e0f73163050f1e45c3daba980b1714193a79cab84661277d11b455326f368

  • SSDEEP

    49152:0RDfGY4MzqVDFDJKt+yEVlISupM+Gr9Jcx2gKG:sbGY4M8JDJy+yEVubM+GBJc8

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2