Extracted

• • Target

    0cbfd26a78edb8d77fb026287c84250a65fd06b3273ec07124f01cc943901304

  • Size

    1.8MB

  • MD5

    d0075d4cbfee076a265ab8647b0abc99

  • SHA1

    789e836177e18275c5b6115dd3562ed03a081a60

  • SHA256

    0cbfd26a78edb8d77fb026287c84250a65fd06b3273ec07124f01cc943901304

  • SHA512

    21ea2fa2fb4a1e8c241935cb704a1abe76b09e3294511ee0a6fe3f0689c0e5f8bb59c265a0562b9f652de0d0d9126543445ea8b2396464a23fb0b4baf6e544ff

  • SSDEEP

    49152:njCTS9+4qSMi8onxR5m9XWUKltU/xFu//jLGdk8oB:n+H4siX5iWUmi/w6To

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2