Extracted

• • Target

    b867c153f64b758a3beb33f2c6425dfcbdd5cdf930ecaf6e6de4f1f62a75cfb7.exe

  • Size

    1.9MB

  • MD5

    30c4c454aa2ee913d2aa2f7787abf34f

  • SHA1

    b34b8fe023e71a83ddfc038eeaba51c4495bb515

  • SHA256

    b867c153f64b758a3beb33f2c6425dfcbdd5cdf930ecaf6e6de4f1f62a75cfb7

  • SHA512

    b767bbf44a6a0a2ff1f3c2e4c13a6f20789107a9ad6daec7322a330e473540d3c8f214c143253055388269b5c58751b3fcadf441c81c23ba76d95854842fc9a5

  • SSDEEP

    24576:AmI9Dhe86/7LueQ7gBktZZEBk/m6FTKbpGGRyQfDjqZeRlSnJM2ZXXJT5V6eaEyk:W1WPQPttK0GRylSStt6eafT0KS1

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2