Extracted

• • Target

    4eb50d175167e7065211a7db6b41fff56be6151010743ac929ece8822f39256c

  • Size

    1.8MB

  • MD5

    690e69f536a77aac38b6789df0dda75c

  • SHA1

    e4ec075220f5e91d89b549780f7113a096e8bf72

  • SHA256

    4eb50d175167e7065211a7db6b41fff56be6151010743ac929ece8822f39256c

  • SHA512

    eb92aefc67a0e2af01d30819fa84c7e8c17e2b8bc0e1d0653358ea71f25b761acd1811aa4cf22b820b6f0027f9b6df1039be04681c9dd754401b2c28ac70b76e

  • SSDEEP

    24576:P4U1sdYo824z9G+6Ry8w+FVFsDsakrirTEhj6M/D3YWnBhU8/EN/ZlVUZkC5Nf2d:P7ot/EkmEd73HCLCSue

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2