Extracted

• • Target

    49f25f614df142ad35b2eb0f4fd80b1f8b5e1cd9440175ecf1621f3eeac1f37dN

  • Size

    1.8MB

  • MD5

    59ecf8215e767f57839f0c2decc7ae50

  • SHA1

    d8cea78d96926260c787ac2af6f9de4b8087ef55

  • SHA256

    49f25f614df142ad35b2eb0f4fd80b1f8b5e1cd9440175ecf1621f3eeac1f37d

  • SHA512

    4f528980bbfa5e32a9a8ff33a14aa7b6b30f1aef9b0d3287c352d6fdc90b2f5b1501623f7a9426b04b0a88d658da5537aa8e3d0c08321c364dda66c9f80d0edf

  • SSDEEP

    49152:mZEWP3KDkEBE0SCkkjN5zvXAiJ+YQcjglxy1SlFtJ:CPgkEBEYkkZ5LXAi4uEzJ

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2