Extracted

• • Target

    73e885eba8c792ff95439378fa7a69d9566a6bd48a99c2a868c9a8056e864c9f

  • Size

    1.8MB

  • MD5

    a6f5ea7a063eb3066297b9aa095665c9

  • SHA1

    e2d730c2d8cacc4f3ea78d90d29817acac9a206d

  • SHA256

    73e885eba8c792ff95439378fa7a69d9566a6bd48a99c2a868c9a8056e864c9f

  • SHA512

    c99ee620f80e484f72b54495db8e1581235aae896f11a00f294adfe47b47cffb00760d97b6868e950c5c1a2c2b738139d03f4f4c5333d9aefb0fbebd19761246

  • SSDEEP

    49152:ox6YZ1rd1NmLDjXppdaSOU4IaqrP58STesScOYUDX:oxTrNmLDjXpjaSOUKIzUb

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2