Extracted

• • Target

    a07e77dc626b8bff8ef56705aa12f6fc46fbb6253155759a8a107f771a638f7c

  • Size

    1.8MB

  • MD5

    6f12f5746828a3006d64db9ce22ba7cc

  • SHA1

    2b8cf73ee97fc1bdb5fb881721e45d17659c6cf1

  • SHA256

    a07e77dc626b8bff8ef56705aa12f6fc46fbb6253155759a8a107f771a638f7c

  • SHA512

    5f6c88eec5fe86ea2f7b0417c09a50d316e336e4ca4614e4cc354abb304760f847171a538367f379b31af9163b4c67cedf8387eff2d70b561243be6ef7787adb

  • SSDEEP

    49152:pYr4Hk8smnZMo1UlfCGmhlj2LJh9duklY:0ar1CsjmL9duyY

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2