Extracted

• • Target

    e29f9cead9e8da727d858708334db33c2e1214335742459932161ab31ef20f78

  • Size

    3.2MB

  • MD5

    2800def2581c630ef006bee68b758601

  • SHA1

    969819cd08be2e79f42f66e4c55df6e0073d3925

  • SHA256

    e29f9cead9e8da727d858708334db33c2e1214335742459932161ab31ef20f78

  • SHA512

    f3ab643cb477840c3d1e6ebd341b71a1d7c80ca31054d894f45869f2bc8daf3dbd0b6ed15b76a545ad8b73a5281b02f007a1470a8732b3037e4fda70437312ad

  • SSDEEP

    49152:+fd5+G11Nk9k1wlvldW9eGlUpIYg/dCSg751NtHHX5ileIRo:+WG1wlvldSeGmIYg/ds1X15VCo

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2