Extracted

• • Target

    23e6b01efe1353ce0295e8653325ed43b7bb6159c3e566f3d489aec97ff826fb

  • Size

    1.8MB

  • MD5

    5aad13810e38cdbb5b8b532358b7e47c

  • SHA1

    108df8ab357348fa37438bc53bdac3a3e12c9879

  • SHA256

    23e6b01efe1353ce0295e8653325ed43b7bb6159c3e566f3d489aec97ff826fb

  • SHA512

    39989f32b0031f92b07604fb7f546fce448fdb6f27efd4d4b7baae12208e5ea766c9538ded711ec067cdb3001576a4c7688a06e42b4d38136bb50c5c1844b12f

  • SSDEEP

    49152:z2+ObzxNExc2T2yIKNwRukMMBTX50v7eoB:z2+OJedj2vMMVyv

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2