Extracted

• • Target

    cf37e48c5c946405c7ce6ee7fe8bd23e1c1fe622634f2cf313eca5fadeca24ef.exe

  • Size

    3.0MB

  • MD5

    da958c70effb1b309c2eed9f568a6102

  • SHA1

    8e68355802e48d7a6f083f5011e96401383bb67f

  • SHA256

    cf37e48c5c946405c7ce6ee7fe8bd23e1c1fe622634f2cf313eca5fadeca24ef

  • SHA512

    702b7994d4341eed475e93f6885c8d4cedaf9e6e6dbaa79f96bcd84e2eeaa989417a47bfe6b46c1498bf51310906327b1b8ddd496bbbae10c7d6686d1dfcac96

  • SSDEEP

    49152:rQ08F5Z7SgcItWwmyMdImLj30S5a2yiWKpS:rQrZ7Sg7tWw3MHEenpg

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2