Extracted

• • Target

    05f426635587082e146d9a8e48b2573c6cdd507310682d306f85eb0878036fa5

  • Size

    1.9MB

  • MD5

    c369428b9ac5862596b8a043f6bcc507

  • SHA1

    69153d1995a54b22e3c1a8e87cb2d82036047649

  • SHA256

    05f426635587082e146d9a8e48b2573c6cdd507310682d306f85eb0878036fa5

  • SHA512

    9bdb218d34d831fc0832c083fd22bdd4c540e9a3cddb754512a65382dfdc3f2e12df526e37ad0cfb6befea6c23ef57181d1168dc510476cfdec35fdc3aa4eb16

  • SSDEEP

    49152:IBPlC5EjKy8+joIDw04M02bhmTfRx2Tt:IXJjk+cIDw04M02tmu

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2