Extracted

• • Target

    6f4928d36727c86c7905d09ba3842913f6f85c495c8b3dfa001e760e1e648eb0

  • Size

    1.8MB

  • MD5

    3a5ff7447416c06560ce00301c03ca92

  • SHA1

    91b8791b0ec355e83d46a88cce965be6718b7b65

  • SHA256

    6f4928d36727c86c7905d09ba3842913f6f85c495c8b3dfa001e760e1e648eb0

  • SHA512

    dc53d8ced93efe04044d2916fd0735434e801f081aafcab12a5d4c0f2edef9355a1f7288191d496b2708f0bab57fe672003c7b510ef34dc7fae9f583cf9da4c8

  • SSDEEP

    49152:ndDMGEu/GdcPmGHIWjdIn2lFHJX3dbB3P:ndAGEueCPEnaJHdbB3

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2