Extracted

• • Target

    22e42ae3d6d680f6996647ab4e90f05535d8b99ce6e92e1fd3ef4ac1700a353a

  • Size

    3.0MB

  • MD5

    9272a8db57c1fd880d7affaa75704bca

  • SHA1

    26eca9e1fafdbd335216e87f2aaae47135ea08ec

  • SHA256

    22e42ae3d6d680f6996647ab4e90f05535d8b99ce6e92e1fd3ef4ac1700a353a

  • SHA512

    aada6f422c086a82edd23de99f0c693f540214aa18888ab7848b4e619bffef323eca3edda998f9d30104771d45cd68a50c0b6a00804ae930427e347539a48713

  • SSDEEP

    49152:HfiGDKwltU61EkWmPgbjU/6OUiaCIHMbqYkr0uM:HfiitU61EkWnbjUyOU+Is5Gj

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2