Extracted

• • Target

    0406f9bf8ca8a1ac0b7f1dbba73d2a85b677471b16fba8ff1c7ecbce37ccada6

  • Size

    1.8MB

  • MD5

    4c1094b6cdbd0756d1661c65d8450b4a

  • SHA1

    5fa2ed814c94a4e939de797d453bef8bb01ead64

  • SHA256

    0406f9bf8ca8a1ac0b7f1dbba73d2a85b677471b16fba8ff1c7ecbce37ccada6

  • SHA512

    368e3392b88bc318ae93ac2bd2ad3ab6fdd47e85adbfc03e39c2f8f9a99a0326a9a3e7be5bc0f45a65c160753c8cf1d05dabd2963014eb7ccadb7ae27edbbd07

  • SSDEEP

    49152:uYIepQaASYThYtDX79ZKmKK+QWRfMbPUgH:IRZNgdZKmKtWnH

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2