Extracted

• • Target

    1b7cf41fdbc6bdcd96b6b985a992b48c5a615d6ff5162962e85b99e8ebf3e2b3

  • Size

    3.2MB

  • MD5

    140256020dfee471fd8671cb484390a7

  • SHA1

    5de69fc128d34506cf0dba945e2892572ae93952

  • SHA256

    1b7cf41fdbc6bdcd96b6b985a992b48c5a615d6ff5162962e85b99e8ebf3e2b3

  • SHA512

    e39897426ede8d879eb3defccdef144a0c42d2a75e8ac9c042d0e0f5f3a218514cd244391d123c702e1afda481fcd9799db520c5169f81c78ac47ee471608adb

  • SSDEEP

    49152:35zwjkCkAtyOd2ACgyhGenX0aVGeed2j9jp63xFGV9Ik/vKTf2xL:xwjMAtyOdjCgAGeX0nee1xkV9IMvyUL

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2