Extracted

• • Target

    12d77eaa3dfa555c43916f8ba6a0055d01c6bab8c0c2037e01e95d85ef705200.exe

  • Size

    1.8MB

  • MD5

    92f28c1323fb27bea459a7788994e0ff

  • SHA1

    9ee151e6687438207201b5297ab6704eedacaaa2

  • SHA256

    12d77eaa3dfa555c43916f8ba6a0055d01c6bab8c0c2037e01e95d85ef705200

  • SHA512

    847ad51b78d2237f09f5ec74cb6df67577a263b7f722f098a0f6f9b41e0a184f017dba376dcf718a579451e567b4b63f6f4e484fa3bde03c59883c97d285c92c

  • SSDEEP

    49152:nIdOvFZhgl75kEOlkpsxlWHYmIkJ8IW8/bAz:IAvFZhQVkqcHmIWj/bE

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2