Extracted

• • Target

    4b9831642c5dc8d92c2fff702fe0917a791a0cfded1ad397117de04b1ce780f6

  • Size

    1.8MB

  • MD5

    658f09f77c55c7fa12a6d5614f5cb51a

  • SHA1

    de55622280dd18c3fefa66442166b541174f07a8

  • SHA256

    4b9831642c5dc8d92c2fff702fe0917a791a0cfded1ad397117de04b1ce780f6

  • SHA512

    c98fabe2b8e136ddf0866b25efd767ea5aedc94d38badd4e5174cb78d79f3001664a094a501446d409ef0985b1493ff014c04650a5703e541bde9195d2e28787

  • SSDEEP

    49152:zKES+cF7PcZlVtyPI3XWWvBl7k2Ul2JwBw:+P7glVkPI35ZPURw

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2