Extracted

• • Target

    0e85d303818a2ba8476ef2f5db7a98935a668d3f37c56151d61755286ffaef19

  • Size

    3.1MB

  • MD5

    d256bb15538bda1b3cd5811f18e5764b

  • SHA1

    3bb393e2fc421c13ea35a2d5aad85cd9bc2a1b83

  • SHA256

    0e85d303818a2ba8476ef2f5db7a98935a668d3f37c56151d61755286ffaef19

  • SHA512

    b39808e9515ae0e3d6a1358c58a3358c8ee821eb20e85af88ead08894cb9632ec37f653ec15249ce0d88834b32b92351ab358f82d207e13d3e066a507f8ae68d

  • SSDEEP

    49152:I5vukTmyzn0xhU+0zViLtuy2ZAa/m0Tv3dR/iVlQhzSWijYpYoXX/F:UTpz0bUR8tuy2ZSAv3LT8jY

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2