Extracted

• • Target

    5cc22df02a09e5394c4026adfa17e10f600350caa217f29fd759984e5a162eed

  • Size

    3.1MB

  • MD5

    91c195db4f614f6eeee5841e99e1ceb0

  • SHA1

    eea4eb63a8ac79601dc2d30ce84c8ea554ff2caa

  • SHA256

    5cc22df02a09e5394c4026adfa17e10f600350caa217f29fd759984e5a162eed

  • SHA512

    a60ba758181622a65d5faa8028c826c6327d6f8fea7c6bc88b320cb52403a3e3454d633c8e962f222b844a10ef1da4370221b5fd90a157152e3b1052917ed332

  • SSDEEP

    49152:JdyV7crnVQVyOR8xu8UuvDBWlU+doR38t4R+cO/ISU0KqZHz04z:TwanVROR8xu8UubBCU+4M+szw10Kq

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2