Extracted

• • Target

    d3f95d99814d66986a7a2edfb3961b6fb96363f8ce989d85a603fadb3a866ab5.exe

  • Size

    1.9MB

  • MD5

    fd14d30672cc6a018672f580f564718a

  • SHA1

    483009421360614e863a11154be348e19f111f8c

  • SHA256

    d3f95d99814d66986a7a2edfb3961b6fb96363f8ce989d85a603fadb3a866ab5

  • SHA512

    35f6e4913ecc30c73d29a6ce023ab0b675a136aa1f4575c3c92652bcd9f65b6e6bc145026f658694f8e98d9229b2f00ae793202d9c2982e7fd1e2032565a1cc7

  • SSDEEP

    49152:zktA/ANosZjs8LeoJCf1q8+P/E2EwSIc9v4dkpeDnER3i:+51RdEx+RjUwd+ek

  Score

  10^/10

  amadey9c9aa5discoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2