Extracted

• • Target

    7e7345e9df9bd3e71dd7355630622cab2b06364e38b571264610c9d5cbb4bfb2

  • Size

    3.1MB

  • MD5

    d0b2946c778be6927a3c698bbd7917a9

  • SHA1

    b1bab4c3f96de14225a6edf0b79f41230d850e10

  • SHA256

    7e7345e9df9bd3e71dd7355630622cab2b06364e38b571264610c9d5cbb4bfb2

  • SHA512

    a1a262b743a47a5b6a4ed7c95ac7062be5ca4f971bc14db837af5f35a51e9e173620f8583b4b2229409e289e83a998a211e9ef0d06b543be04ba2186f16eec6f

  • SSDEEP

    98304:8WW3/klT7zVG+ht05K0Mk8nSacczEBaOrq6ME/Nm:tWP2GrQP6N/

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2