Extracted

• • Target

    e70cd8d7e7b49031f15c85f0bbcbb5fb5c1fb74ee0c309712c1ab096302f1d5f

  • Size

    1.8MB

  • MD5

    8e6ec981a34961d58932b4831474425e

  • SHA1

    94969f0d55c7e91b72b34ce93612b31c9475e376

  • SHA256

    e70cd8d7e7b49031f15c85f0bbcbb5fb5c1fb74ee0c309712c1ab096302f1d5f

  • SHA512

    59a2c4f5da7bf6af2b951b9b83e434d46bb9ea5c116a798eb4d636c2a52093c295180aed060bb2beb4282581984eebca36845c045c777edb7af104e3d7c2916b

  • SSDEEP

    24576:A+7ir+PQ/JyC9mlXtYKcahROIC0z4yH+6JJh43rFCdkPj47IwZw7VWueVCqG8+ns:WrmQROlKKcaO44yHriCdow2cuGFG8+n

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2