Extracted

• • Target

    19c16dc48f8338ab746a0ad51d6bb02bb545dcc2045b9344089199fdc06c035b

  • Size

    1.8MB

  • MD5

    76015fd73208ee7a0dbb834a6b582d06

  • SHA1

    f29f5c9afba2cc9ebba358db3356c2aac0701f0d

  • SHA256

    19c16dc48f8338ab746a0ad51d6bb02bb545dcc2045b9344089199fdc06c035b

  • SHA512

    bacc05bde9ca13791d223a42ac04b78d2e7d7407cd2b6daff29db71618fc8b84e85444d60bb12ef43bca4865e692e68da22787f69ff22d990cb61c1604ece878

  • SSDEEP

    49152:ki+wnJ2RFwxVInSqpJJJ6XNajg5h5Ylx89O:kcKF8E5Owjg5haqO

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2