Extracted

• • Target

    4b29c91771a3da7cc2c8491c444b2de9f8a97c28a0035039b6331fadf33cde34

  • Size

    1.8MB

  • MD5

    0395bf8e2930c4ddb594fd21842c51e5

  • SHA1

    ab67dadad8635c0b1d4871566a4ce6725e4ec1d4

  • SHA256

    4b29c91771a3da7cc2c8491c444b2de9f8a97c28a0035039b6331fadf33cde34

  • SHA512

    f4775d28ba2ab883412112c6134746990f3c446c0d69e605015c98f0b4ce9ba5c533cecc9eb6a419baf3b380467b72695ef572e4ad3c9bcb23db1efea371c588

  • SSDEEP

    49152:Wagbax7yRJtrjtoWcbtWJ/omHPtMtp0fWlrl:Wre+ffOtWRPtH

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2