Extracted

• • Target

    dd92a899ebdd99ebdd2296bd29f9cb9b0cfe61cd27813c836b82961d0c58d30a

  • Size

    3.1MB

  • MD5

    29323178d5321943557462215cda1f3a

  • SHA1

    45c2e395831ccbd302493b697d94f7f9bc9c66ef

  • SHA256

    dd92a899ebdd99ebdd2296bd29f9cb9b0cfe61cd27813c836b82961d0c58d30a

  • SHA512

    953aefdf5f6fb7715064264a6efaa8812168c576c8d6eb7e64c3d7e820283a53f6a30331d835575cc9a36cde1e559704954c896bb488ad22da3e1cd865885399

  • SSDEEP

    49152:Ot21yjuCc9PXohvuhbjj5PU0Z6mKLJMq0:OgGuCGPXohcni0Z6T

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2