Extracted

• • Target

    6fad314e63e334721c003bd0a764a981ab4cd41072c00d6ebe1a96453ce46880.exe

  • Size

    1.8MB

  • MD5

    4e4a4de77b0d02ee3ce874cc47eaf7d8

  • SHA1

    44041034e1ec42d91721d0768ceef72a03721eca

  • SHA256

    6fad314e63e334721c003bd0a764a981ab4cd41072c00d6ebe1a96453ce46880

  • SHA512

    f7ae84e05fe6d2f0b7d073239bc4cc1861c1a14e49c1dc7b53a1de8dd07bfe2e20ba073bf764183dcc59daa2f0dd6556f1f7a6c1c6b3ea05322b5847ebc47bc9

  • SSDEEP

    24576:3smA2lL6lF4kP82e6Bvi3O3y4Rn8Ek4BtwV/J3Oaab6p3xgVZWXnL6k+mGgTBTr:7fsKMC3Ji8uBtw1saJBYanN

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2