Extracted

• • Target

    ac5e9db7bc831b339ea7beece2aeffa5c88edf0831ef6336af8a14cf21baa164

  • Size

    3.2MB

  • MD5

    dd09bcf5f832244f625969f458bec3e4

  • SHA1

    6fd3326abe537255b113a3f5af675ca7f2d536a9

  • SHA256

    ac5e9db7bc831b339ea7beece2aeffa5c88edf0831ef6336af8a14cf21baa164

  • SHA512

    c645a1c1630988d41f74dde9152ddbc8b07c0abe77c511a38009ebdafce230434953344eb6e247c883cafaff792abb9febb08c75887482ec2ae8eb61b6d1a7a7

  • SSDEEP

    24576:hw6cs26DPW90gumu1zKz866EnWx0CVt3dARjlx6r3VVBPcsuRtDipAB+5yXt+60n:rb78ZOjARjl8hXrI26sQ5ty/z6fUYc

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2