Extracted

• • Target

    6e03df5a585b77ea128f3db1549db45288fad9d3b530ba0761826b2b6f440efeN.exe

  • Size

    1.8MB

  • MD5

    27465b6ccd607f0b91de48f6cdbfcca0

  • SHA1

    799f3555b8f07e98e748855046e98fb281ecafe8

  • SHA256

    6e03df5a585b77ea128f3db1549db45288fad9d3b530ba0761826b2b6f440efe

  • SHA512

    38f426ae27737271a6e4abadd8de675eddd4b716f55770677c24ddf06bc4d039a4371aab3d76d845e1c4ccd5e216bce6435df3d4b215636c56303b43ad350a37

  • SSDEEP

    49152:vkjYxvPfAZc36V3QcLzu8AohKBX5MqyDjrK:8jYxHfAZcqV3Qwso4V6qyq

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2