Extracted

• • Target

    4a8fed3b517adb5fc2c5f4f67cf4464ea2218d4f81030758034de2eea80cdea5

  • Size

    1.8MB

  • MD5

    06408230917803fc68f352692ae47303

  • SHA1

    dc8b4f1484e83826b33ce5801def1baf5f72d23a

  • SHA256

    4a8fed3b517adb5fc2c5f4f67cf4464ea2218d4f81030758034de2eea80cdea5

  • SHA512

    2111fb782b2a9fce4f45c5106ef80a4bcc034d42ec3bb02900a6b0fa056b5447d53e3b64d0d24e0978ea73c74b685088a9605a2357423ee4844aafcee304cea9

  • SSDEEP

    49152:3s6StqPQKmSNkniQ2AVxTjOKABMUhOPVpb0cCKfVeZ:LYqPQkNyiQZ5jEBThOPVpb1y

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2