Extracted

• • Target

    955cdc1ae6844736ec738885dcc8fd1d93edffae840e97339cd6d25cb7fcddcb

  • Size

    1.8MB

  • MD5

    fc2ea9cf6d28e53ae76db4246bc22b22

  • SHA1

    fb1354becff6ce6a3ce5d2fb2b548184cfa09322

  • SHA256

    955cdc1ae6844736ec738885dcc8fd1d93edffae840e97339cd6d25cb7fcddcb

  • SHA512

    c7623be1bea171df45ea9d6f90663ba06d563258452f634958889d4ffac95460ab03e16908a5e6f07368cd0e6a516a6827e645b98cf325452380ad20c674bae8

  • SSDEEP

    24576:LoOZ87ALBn26PdtKdGxGA9NWejdp8aDkt1TfXEabQL9D8YB3mrFe2zxjHQ6QmGEd:L3EALBRSG99NRUT7EaQBDtI9f

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2