Extracted

• • Target

    e89042a14bf7f13d9be99565bbc18b5f.exe

  • Size

    1.8MB

  • MD5

    e89042a14bf7f13d9be99565bbc18b5f

  • SHA1

    91a2d0fec7881c7cd9b6d973a77df8b4a22b20f3

  • SHA256

    2a253f17a89258bc0517703efcea3484073a00ae3cbb8b0ddb29bebf9628d567

  • SHA512

    5c236950fe288fb140c48fe176851af32113ab5fd8be8a871bbd6098d0577f710921594589ec97a8fc3027540843ba66b93903e0416ab6a5c9b331042a0d5f9c

  • SSDEEP

    49152:BIZgPJ56Y0hiUefDGhutUPAkZhqAtOf/JpQKJ:bPJ56bhYfD6r/ZcAt1K

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2