Extracted

• • Target

    random.exe

  • Size

    1.8MB

  • MD5

    5e6b60da64efc7d048c73ecd9253278d

  • SHA1

    25cf8244b56b4bb00d10c953169847e9b1b76712

  • SHA256

    59e10403580ffb5ad0ef689e6abb964fae33c8f92d306241ff11859ef1a0772f

  • SHA512

    efe9bce4c473def78d44360dcab3c107de84c4438f03d67c3e97c21d5cbe4b156f6d0359ae514be63184dc41f322c505e428dab37675fcefc6199334567e349d

  • SSDEEP

    49152:caCPqGHdl4RfJMY4EqZ/PvuBhnscbCoY:tLJMYcRvuFmoY

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2