Extracted

• • Target

    5bbe84de8fef7c5c1d4822f964744485aa9579291e423e80be5909ec5687f5cd

  • Size

    3.1MB

  • MD5

    ebfb8e7bb5c27d53672dd12ff9fa0689

  • SHA1

    ac7053d972929ac015e1f772c4b230841ce9219a

  • SHA256

    5bbe84de8fef7c5c1d4822f964744485aa9579291e423e80be5909ec5687f5cd

  • SHA512

    e02263dee14b227488acc21124b16c08ee4a2378ac39773ce0a126acfe98e3779c2caae27a939c101aa51d9b73ae9a45d86757167ed5c864fec550dcedd03781

  • SSDEEP

    49152:R3ufSev+tx4BRZFIAPh78cDxMCBZA2T4m0CzgWta6:R31evyxwRZF7Ph78cDxMCrA2bvta

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2