Extracted

• • Target

    904f95e935e1a1809bdc2b052e615493fc7e793dd294fb289823c34d2453ede2

  • Size

    1.8MB

  • MD5

    8a9e86a2a4f2335a6ba464e62028a694

  • SHA1

    f156804274de9b3f78ccf8c8de49c14d9090d3e1

  • SHA256

    904f95e935e1a1809bdc2b052e615493fc7e793dd294fb289823c34d2453ede2

  • SHA512

    f0d8b7ebbb390539ff2ede875621a0eb075b940383a7685eaf3c2c215197156decd45d7ac9500c602b328a45de0c536766c0964e14da8210fb101e84a6564e37

  • SSDEEP

    49152:x7w7GZHCLKlyKmSheOr2TpbBova0QD+AdKNt:x7w7GZGDzSP8bBEaD+nN

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2