Extracted

• • Target

    e3089be07c289f99c7f7ed426e576f1fdfad492114a9225d211ccd61126c4ddd.exe

  • Size

    1.9MB

  • MD5

    9b409c7658602705417207570c1c5986

  • SHA1

    9c1da96648879dd105edc92bf55eb083d9f56541

  • SHA256

    e3089be07c289f99c7f7ed426e576f1fdfad492114a9225d211ccd61126c4ddd

  • SHA512

    b36c635322663a737036cafcfffe209d0ef741aaa4df297967a14ca59b6729a1a673a4658bc6329e733c246f021d045ecb4e223a5b45401395d126150e0d7d17

  • SSDEEP

    24576:V3J8xHUeC1B7zOB48M/SAHSueO4ja+F9Bm+5v6mMDscNImh03NfGUhjzJz1GSokh:pqtxBToX6asfm+5NA7hiG8d1G5kmOnp

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2