Extracted

• • Target

    48c2b407f5d5babffafbdd7589d1d6c0470c17b46dbc87bbdafb5bbc256de3adN.exe

  • Size

    1.8MB

  • MD5

    334bd1318cf389af116b809aba1fcaf0

  • SHA1

    ad8b72e1a4661de0ac1adcc2370e1ac20a84d54e

  • SHA256

    48c2b407f5d5babffafbdd7589d1d6c0470c17b46dbc87bbdafb5bbc256de3ad

  • SHA512

    6750040d74490180338b47dc62f5344714ef7c0ebe08e5f6684b8412b6860458a20613bf32511f1513b61fe0cd1d6c0264f857698533ce8700575c901a3c09c1

  • SSDEEP

    24576:BrSuMl6C0NIp7D0soei9KRZPkkv3pQtn64xq97LTnAdn8rYXAmnvli/meMoqAkQ5:FegC5SsoGRV6t5AD68rYTYVqAkOp942

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2