Extracted

• • Target

    random.exe

  • Size

    1.8MB

  • MD5

    5b7618b4200c4288b830a4c0bbe23348

  • SHA1

    5676c7ed0d9203a7ffe9197bae7da5f85c56106b

  • SHA256

    9f7d849e26b45382639da7c45256fbe0963ce63554bb9c8b20dfa9216c9947bd

  • SHA512

    a914c364f053aafb85d4fdaefa9d046a498713d4bf78bf4d0bdb286cc921f6d5160d5a1a7a4f101b46aac4e67e295e7a1a954e9573d95457df7b37a4ab21fd78

  • SSDEEP

    49152:8/08HRt4iYyXvvCLN8ZnysbKFHiY8VnVfut:8/0C+9yyN8EfFCZVc

  Score

  10^/10

  amadeyfed3aadefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2