Extracted

• • Target

    59d91a122525ece9e695e53d1ffda56dd4c0f779869565f00a173a5bc36c984b

  • Size

    3.7MB

  • MD5

    023aa471381bee5989713c7504262e40

  • SHA1

    b993c9b6e6ac6d0834f91f9278695b671a2a3f07

  • SHA256

    59d91a122525ece9e695e53d1ffda56dd4c0f779869565f00a173a5bc36c984b

  • SHA512

    ccc06bf5ea781eb8535084f73483f05018ddb9e6ed5fe8839abf202526183295ef138d34f7893eaf07f3282f66f3e77e9fc6f8b685e1035ec6373ccd1a67c5b4

  • SSDEEP

    98304:xPb+wS3Rw+TGsrzOvPL7O6pGiBBAggboYLuEmsP424TFN2:BM3Rw+T8vj7Dph00l5Z2

  Score

  10^/10

  amadey9c9aa5discoveryevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1