Extracted

• • Target

    0c41774a73740cae1baa67ad195a351093961e6ddd3a223aa870d730a69926b6

  • Size

    3.2MB

  • MD5

    1f45b8c39df6db7e38e676efe73e6b68

  • SHA1

    18ba2206fdcbba92b07aea6f18533158aa62609d

  • SHA256

    0c41774a73740cae1baa67ad195a351093961e6ddd3a223aa870d730a69926b6

  • SHA512

    f9842df7e8aee2fbd81bdf3a6240162b5f1f5129299f9c3258b6a6c45643a061522c06d569c6c0bf2be086b193400e79e9f66eaefb5e2887e113a4852ab45e45

  • SSDEEP

    49152:myr/1b7068oHXg2osJ1g4+zwOhFUhI6YBRbQ6xbkMkCOLGt:nbRA68oHXVosJ1L+sU6kbQ6xICOLGt

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2