Extracted

• • Target

    142ca39c5f9770c48916f0482c034a6128599887b8fecf48429336be6be0e26a

  • Size

    3.1MB

  • MD5

    045c234781fc9c05bba80632d80ee423

  • SHA1

    15f1f0badc31d97e56a3ad5b194c0239d312802a

  • SHA256

    142ca39c5f9770c48916f0482c034a6128599887b8fecf48429336be6be0e26a

  • SHA512

    8417f21cbaa6d1cf87d808444b0b19e536e31e2fb822584e38e59e368be714e6f5731ca5882aff966b2aaea078ecb629e30762d36accb34a2dcf03d2d3923133

  • SSDEEP

    49152:zqyVmFAolvLhjrpDUD+C4LHkTpUjJOQFs1ybZag6:zqyAFAolvljrpDy+C4LsmsQFCyQg6

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2