Extracted

• • Target

    0b4a3ac9b4413cb687e64d4b718afa284bc8c0882c2768973317620cd83d460f

  • Size

    2.8MB

  • MD5

    aa65c785ce5ec6a4648414bc13fe24f7

  • SHA1

    1e4fb866064a7248308921ab37767f2c7c0e2886

  • SHA256

    0b4a3ac9b4413cb687e64d4b718afa284bc8c0882c2768973317620cd83d460f

  • SHA512

    e077b949cb299e827c6842e87884271bcae02d5e1520d88fad52585adbb8e9e822861ab40cd0451a848bc396d1657dde8a7a034edddfb9545130cb56c83e4bad

  • SSDEEP

    49152:595tlWy3vB4D8LQmfAoTb6Wzyuzp1A+2prTB:5jR3vBDLrAoaUlzp1A3

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2