Extracted

• • Target

    FSFEK_random.exe

  • Size

    1.8MB

  • MD5

    2c780bd0b93d85afbad23124cf8994c2

  • SHA1

    267288b40a48cdb0aee1bcf8972f4e25ff72f4ff

  • SHA256

    96a1eea0f525785429d36cff82916e54227be6a3750796e05d594e952a213ec2

  • SHA512

    d2eb2bb12b7484a10f9517c2bb1f1095e5d234aedfa7730b9196e95b004d3db0fb79095a97d1643ee13db04b66f1718f9ab1a479e6fa97f811a6fb503b91bbe9

  • SSDEEP

    49152:He5+t/pl8vQaHskaf98eUfLvELLgsuS0QJt5:He5+tRao2skaV8eSLv2gXG

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2