Extracted

• • Target

    5ca130ea39a5c3774680ba6f8622101974a2d03768eeacae26383a038ccb217c

  • Size

    1.8MB

  • MD5

    d91e39f31602ef2bb7bdf94e45a074ee

  • SHA1

    119160fce3d7271c13aef71fc7e197e35159b2ff

  • SHA256

    5ca130ea39a5c3774680ba6f8622101974a2d03768eeacae26383a038ccb217c

  • SHA512

    871d655511918846d51036e52f153502b2be162ec7f9c146da817a29fff5b7587e4fcaa076a84e7e30344e9dc115ceb8e2ec155699eb278bd6a3edafe6b552d9

  • SSDEEP

    24576:W4xr0H/+XWDBMxM3FPT0ExjeRgX2PuNz6FEOSj0+3RikbYr9eb5HtzPGKtDOukI/:WWAbDBtFBr2kBnRHbYrUDfIs7S1onUT

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2