Extracted

• • Target

    0c4e2a867e7124500d74d6c5f3eb84515b6d78c1580e106e1fadeff87f12e4f1

  • Size

    3.1MB

  • MD5

    f1c895b6e93d8df125589c7503a5e248

  • SHA1

    a0388aeddbc5e70031430feb37854c52be8441d4

  • SHA256

    0c4e2a867e7124500d74d6c5f3eb84515b6d78c1580e106e1fadeff87f12e4f1

  • SHA512

    4c4616d3c605cd5f0169790a3feea853da14955d157aabd405b496b29d64d997eb715b81115de53abc1650b7f78a01030595a959fb3f03392d1ec2c3c2abd4ac

  • SSDEEP

    49152:Gz5LvcLUOSVqylLkgYu1TWCQLJxjXdE22ieBvCNkmK7PdZ:qZcLUxoylLvJ1TWCMJjTVrwxZ

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2