Extracted

• • Target

    a2adeda5fc0eeb697b677f69111182c2d7361694a8b776e418fb67a1da57fe9d

  • Size

    1.8MB

  • MD5

    4eead9b286145ef1ec14c5e4b8e8d5c5

  • SHA1

    adcdaa0fce97e8cc3a0b113f9ed83f07f888fdcb

  • SHA256

    a2adeda5fc0eeb697b677f69111182c2d7361694a8b776e418fb67a1da57fe9d

  • SHA512

    1a731260d1a9eaa46817a8ad44a5e35638e3144302aee08ef1960b05a82b5b7093d6831d77ede73863f99644f24f53435acb517ce1d620b4a330e06c2937487c

  • SSDEEP

    24576:MKPcPJZ5yk8DKROJDY+MBhJ4XRf0+t7RGYxu/7naXyydd1OedtYRGciABO1XZHMi:DPcxZKP9WH4NlJx2qdd1ddtrd

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2