Extracted

• • Target
    213c5c3b1fa42206e807c2c363992958.exe
  • Size 1.8MB
  • SHA256 3c20ebfe4575a9d9b7c7bb7093dd7c0940ee0fc5da3e50923876e1ade785c323
  • MD5 213c5c3b1fa42206e807c2c363992958
  • SHA1 efa21b96fc73b01cab892b952e0463b9e2c4ba23
  • SHA512 b35dc920d899e4bd5845d5eb2ed8ee756eb180f9391fd7fec375e3a071b0814c92e53442e01c9543aa466a35a5790a21e71ad25b1043b17c78ef3184e5cd07e3
  • SSDEEP 24576:uczVM0solVBmTgwWfzjpUG6I2fl2zjUQUMOdZO1G6ZgrhwNR3ySa/ioHEsx:ucBRmTNQW2PUQUqG6eregK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2