Extracted

• • Target

    fba5d288281ac710fb52a4f7e4d8081bf18e2d68b94eb346d696c5ccf21e9417

  • Size

    1.8MB

  • MD5

    89ef0f8ccf69682bfa9c423d8bb271fb

  • SHA1

    f122c565c7d4773a1c0a62b6665f31b040953c0d

  • SHA256

    fba5d288281ac710fb52a4f7e4d8081bf18e2d68b94eb346d696c5ccf21e9417

  • SHA512

    f7ca9cfc3eaa3174c30edd6bacdf1c21143c5cb0589283c918a2a0fd74fa0a2ca40cef0cc6c59ca453d6f3004e47b58148d50ec00b21b9e6e48dd1d9c45030c0

  • SSDEEP

    49152:GTOJga/aRqKD7zry33SD45E6VnlOM8du6RL+z4:DJ//aY07zrynSce69UX

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2