Extracted

• • Target

    a4c95de00c945a92cb302f8b895b703fab1024aebf187a19d2066df8c046d5aa

  • Size

    1.8MB

  • MD5

    55430f9338bfacad8968c87ce549f0f6

  • SHA1

    d335b4884e90e0ec1e8380e2e02bd37e8253c199

  • SHA256

    a4c95de00c945a92cb302f8b895b703fab1024aebf187a19d2066df8c046d5aa

  • SHA512

    da9c8c300f5b2898e184c0ed8e077150377b385c85055eb130cf21b81677657cbe38eaf4e7b4eef4a8f493444821272d83a34e71f41a880a960e2c47bc158ca2

  • SSDEEP

    49152:F6DGNsYkN2XJizTwOJXZboQgISHFDOZpV5pRwDo7Q:gDRYkN2JizTvJXZbyl6ZpVmZ

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2