Extracted

• • Target

    a9594e93fbf414138494e98766e036037b0e6f0aae486867888f78d77d2ebd0a

  • Size

    3.1MB

  • MD5

    f2b2123b289c47c223ff20d6e8d633d1

  • SHA1

    8a4649721e824067af084c2a6d27fafb451d4e8a

  • SHA256

    a9594e93fbf414138494e98766e036037b0e6f0aae486867888f78d77d2ebd0a

  • SHA512

    c145eb5bf5062bc6a9093dae2c6a32df88a511f6a7d1d599027fe35543fc166d139c84797ed7e0c5ea88f58cbf09c3efe23620939a2fc2c013d17e6a6a676d73

  • SSDEEP

    49152:DryZQ69HUfX6scALvi5XulDHX2j8VyTbJ0z6ySSGV:DkQ69HaXJcALvi5XulDHXu8E5G6

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2