Extracted

• • Target

    6fa186772f5ac72388ae79d61327b623afcd6962f9bd1f46bd4adbf54e3b4ff4

  • Size

    1.8MB

  • MD5

    1b3978e2368597890c5c887118e59c04

  • SHA1

    1cee6312e56f0ea8efe8fc07cb2f125b177c5084

  • SHA256

    6fa186772f5ac72388ae79d61327b623afcd6962f9bd1f46bd4adbf54e3b4ff4

  • SHA512

    a51b09b1271c077143eede4d808a4c9ea60a060840cba40614aaf3c16436d377e0547c76a8fb67e7a4defa47617a90598b8da2e86c24a19d859e175937c2879f

  • SSDEEP

    49152:alYJay7ok/NNY/xKf4p1Qfdek8necp8+dnkLgXu0QxtaLzYiPE:pJ3vkcfcTe65kLu9Q74z

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2