Extracted

• • Target

    203a5b531b8803628b6aa37e8a7e08a0c83e3f10bba6155e2529cc0bc97548f7.exe

  • Size

    1.8MB

  • MD5

    c873c0af86d36318f23bf63377181cdd

  • SHA1

    1277d3f0a9ceb8260fbe396f2a7369381bfb7406

  • SHA256

    203a5b531b8803628b6aa37e8a7e08a0c83e3f10bba6155e2529cc0bc97548f7

  • SHA512

    abcfd087c56daf93ae7da1ac7d13aff04be70eab6c2b256fca1b4fa3884771b8da8a1fe4af9a754c5de97f6bb68b1213ba1e1f282e439a1c314b52b46f82add5

  • SSDEEP

    49152:3UD21gzSJUaD6nFX4q0KPulTJW1gERg6tIev8bYe:3UaUSJUabpKP4kIe1

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2