Extracted

• • Target

    41877f9e09aae067dc58c6b1e29da9d93f0773b742f1e59e6175fe57ddf052ae.exe

  • Size

    3.2MB

  • MD5

    0a7f88a22ae393be6aaf81e99911559e

  • SHA1

    618bd53dcb394611c6ee90199abe534d40dd6958

  • SHA256

    41877f9e09aae067dc58c6b1e29da9d93f0773b742f1e59e6175fe57ddf052ae

  • SHA512

    385f7e5ee456ef3c8e61822d7995a7703da0e97e921d78f66871b1b2a9006713e66a0130ad7ddd3cd5f8119df538c89e1f1987045538880d52786a5a0fe821bc

  • SSDEEP

    49152:dFDnA1x/lmFNuZv18V9BHMhAbZXe8NyJIQpYGKYFsg02nWqvKS:dFDA1x/lmFNuZv18rah4OZomsg0LqvR

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2