Extracted

• • Target

    51751cfe3502e3b68270e1854997d850ba56001215ac9d3f62c9a23ea2b12f74

  • Size

    1.8MB

  • MD5

    0a6fe45280d6f07725ed1d7644fd4d2b

  • SHA1

    4b5d2751cedbae634c13d226666e32647b30a84d

  • SHA256

    51751cfe3502e3b68270e1854997d850ba56001215ac9d3f62c9a23ea2b12f74

  • SHA512

    b70caf2fa72fdf6d12e3905134f6f9a711dc62ddad194fad9b8818b7a81074f06a4f65c6eb744e9b9b6cc8e5d262d98e1b66a0dfee539543dba6a5b0d83f3d75

  • SSDEEP

    49152:0xALj+rrYqwTPP5eY43RGqJG4DhHKgh+U:/j+rrYhPsHRGmG4dq

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2