Extracted

• • Target

    db1011ba1c9de404c7fc02af28248a46527a8fb445a6101fccdbf93b5ad1fc32

  • Size

    3.1MB

  • MD5

    eecfc5569c5fd3fd035c2a13302c9fc1

  • SHA1

    18975d0a1288bcbecc71d0ff8e0fca672974bd9f

  • SHA256

    db1011ba1c9de404c7fc02af28248a46527a8fb445a6101fccdbf93b5ad1fc32

  • SHA512

    cf520a59dbb7f3ed5bd9ce42ce369a48ff99a68fc8e1c2d584ccbe6adb92fde312519101b9295aedb07812e59bf130b95b3a111c06966284cc7329d5cada65b3

  • SSDEEP

    98304:5DX2Mi+ZmQKtG7ttMabA9ihMhZo4n7ajp336:51Dp9hMbo+7Ip33

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2