Extracted

• • Target

    838fd83e8b1c6106868d71635e8171d9b23bc436c2985e395d8c1123e0fb3ccf

  • Size

    1.8MB

  • MD5

    e3462e542fc520e4524ba6f345d2d8c9

  • SHA1

    5754c8c847c639500cb9e95fc5f42d394365bca4

  • SHA256

    838fd83e8b1c6106868d71635e8171d9b23bc436c2985e395d8c1123e0fb3ccf

  • SHA512

    99f0f5994df945ade3833db239c562a83e83e0aaff0b11036ee3a2b4ae50ab4628b03effe6a272efd6d85b02d4657b784f7f8fa0fbf0f9b9589e6c1a1211925d

  • SSDEEP

    49152:qx/qTWysRpu4SKRZOArq3EzY1CAAyXxN:sCTWNlnhzk1CAH

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2