Extracted

• • Target

    507f8541ce9f8946150f6409df7f4f5d3fc4e7deec81ae0e3e72767ba992e38f

  • Size

    3.1MB

  • MD5

    b4d63aafd49aff9d72f59fcf66f4ea62

  • SHA1

    6ae567ef5d4344c890145dda58e731b5ee67176d

  • SHA256

    507f8541ce9f8946150f6409df7f4f5d3fc4e7deec81ae0e3e72767ba992e38f

  • SHA512

    b90be1c2b500d78df7aa027d7ba41074d52d118411c43ca41d9d52ec2162691c4efc7dd5d20f04333286a7901f511fc67ce60ca34548d01dffc4b075904f65e5

  • SSDEEP

    49152:1zUtWvOA0FhDRLyYq5FRD21Ofuf4WxsZfrlNHzq6fX3:fvOA0TDRRq5FRD21Zf4RZfrzBfX

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2