Extracted

• • Target

    df6a32a17680ecaa269b65ad7da8d487005e4e45334ffae9a4f4da330569b399

  • Size

    1.8MB

  • MD5

    efa5f55492fdda407891d1d5fec52a0e

  • SHA1

    f4239d36613d4f04a218c1b0dd7dfb9883aeaee5

  • SHA256

    df6a32a17680ecaa269b65ad7da8d487005e4e45334ffae9a4f4da330569b399

  • SHA512

    4724450784418d4f170d1a3962f24b744eb488bfd90c0518a84fe7bc18f566df80a57e5519d8d4a07eb5d3538f5de5d97b4c4bd698dc506cc105282ba88c28e8

  • SSDEEP

    49152:b3BUxhodjM5FnK0JIZnmUVIReFf/tMzL6rn6av9ods44Q:b3BshIjM51K0YmUVeehKP6rnlv9odQQ

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2