Extracted

• • Target

    36c717c077bbaa444800cf11536be412.exe

  • Size

    1.8MB

  • MD5

    36c717c077bbaa444800cf11536be412

  • SHA1

    4b679b3070e89bc7c8eaec6149a1f79626f2116c

  • SHA256

    04026e4c5294569c0b9efbb7afec5da3ba5078cb1b54612038e40272b8cbe82f

  • SHA512

    943f141fd2bb9fc09f0ba71d34ae6be75aba89aacb5b3986c7c3b51a9d7c6c7f2702ad2edd539b467db110179703d74095570a54ea963d5b38ae9e4df8a76d32

  • SSDEEP

    49152:xgmxe31qUGy7J51bKRMIzxVrvI+pqs+ZK:xgmY3wU1LArlVks

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2