Extracted

• • Target

    48fdb9a069ec832fcfab7c90924e769c56820136e735cc5013893916f856a346

  • Size

    1.8MB

  • MD5

    8c877b377a713a0fb9f701ab5dd72cb5

  • SHA1

    8f95385c1810706b98c14e75784ef0e3a4290987

  • SHA256

    48fdb9a069ec832fcfab7c90924e769c56820136e735cc5013893916f856a346

  • SHA512

    8a0f16c3b919d6aa723c1dbfadb6abb4fb5dffea70fa639274551c34acd19c007d419b6f4c7cbeac7eaf5d550672a5df3c2cf995efb4086a11e1108c37d04770

  • SSDEEP

    24576:xFzr9d3ixHqmwylaNqBC2trd9Q59YMO3YLT6hkLCj+wf5Des4M0JPixyOOuM0RVu:DiZqmwxcBNrPQ56oL5M0JsFOMUS7J2

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2