Extracted

• • Target

    9bbcc3d101c01634c8975d660b299af7934617f0995534bc650085407f146e7b

  • Size

    1.8MB

  • MD5

    d9e2ec9d06fc57d859111f72bc018b86

  • SHA1

    483cc0c64a5f8d81267a419e095ccce5c3365442

  • SHA256

    9bbcc3d101c01634c8975d660b299af7934617f0995534bc650085407f146e7b

  • SHA512

    0db25db0ce800d309bd38132ee21f088709ab98903ea862c0916d8673dc044668663f964e4cb3f6a084e72e3cb2e7cc3b34d0f3c75677c0a1f650f668e5efd73

  • SSDEEP

    49152:yg1F/MVss6RDgyJeECulebCKfJkWGTgddGoV1BN0uEcQR+0u:bF/MVssqzYulApGM2oXcmH

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2