Extracted

• • Target

    67e0bf1da80f6b90ac446cd7e6d1e2c8e3ff05073df0ac031faa00ff8518b9f5

  • Size

    1.8MB

  • MD5

    fc70ba83bfcec1d0389b6f7551d46036

  • SHA1

    4dc02076b394040e1c51776a0ab0cf310c3c8624

  • SHA256

    67e0bf1da80f6b90ac446cd7e6d1e2c8e3ff05073df0ac031faa00ff8518b9f5

  • SHA512

    78d9ab6cad56e57771e4a7e2fcc17743a0c36002f5afe0d1b8acab116d8d10c943ba7edbca8391a402b3343ad216c466c17102936cc1f1f0013873ba9b69116f

  • SSDEEP

    49152:J70Q8JZ4/oshT+I6o1UFZ7D0uJE2fqD7Pa6Ap:tJoshMomb7IUfqfPadp

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2