Extracted

• • Target

    b7b3cbf5c941ab176ce5a6929a5bd28ba27bc85c5e51a1cf8138f7201bbd379f.exe

  • Size

    3.1MB

  • MD5

    92a515e103bbe713ab7ca78d3389adee

  • SHA1

    81fa10f69fad66c5d907dbacadb469ec2ad5a1e3

  • SHA256

    b7b3cbf5c941ab176ce5a6929a5bd28ba27bc85c5e51a1cf8138f7201bbd379f

  • SHA512

    7ed20602ce3c0dcdf74f0b2b717efe29238a6ba8517120345aa11d376972ea8854d369aaae24d98112684980a515344d5bb5ef169384dd3b1a4f715ffd3d33f8

  • SSDEEP

    98304:dcFxcR7hNjHKfmSN3d5hhwtLCw+6FyCCg5v60G:2FxG7w3hhwtLDNFyCCgE0G

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2