Extracted

• • Target

    0c691b6347ea8ec475457593efb9870aa78dc9139888f8ed94048c5e175f9b39

  • Size

    3.0MB

  • MD5

    eb29ed48dbab05ef234e3d96323926e3

  • SHA1

    a0fa1ead28f4eac0dbac34bd1ebfffb7e3628c12

  • SHA256

    0c691b6347ea8ec475457593efb9870aa78dc9139888f8ed94048c5e175f9b39

  • SHA512

    e8bf3273e64f88693d54cfc94445d213a88753b6ff524c0acb32b94bafabf2bae285499b23c9d5a91c72cb3f74ce20ca1c0d1f5b9b545690dbbee17aee02e89a

  • SSDEEP

    49152:BMFMeivnJygidiYy02VNGm77QG8XKePCmsTegsr:BlLnLidlyBbGmnQG86eamsTxs

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2