Extracted

• • Target

    0c7c79b06ebdce1cfdd30af9c1ea2afb962426dfe27cfe036f21e7818549c483

  • Size

    2.1MB

  • MD5

    f22b0344fefdf201d07314323a83b022

  • SHA1

    6dde721e943cb298e50446083c1d7260071aaaae

  • SHA256

    0c7c79b06ebdce1cfdd30af9c1ea2afb962426dfe27cfe036f21e7818549c483

  • SHA512

    61f92704af7395159edb879fe394a64e30b0b0818d642be1eeecafeee54e22570add0e4eac88c83e00cd9a4642e09a8529c77a69b4b7613bc3bcb9f78f50feac

  • SSDEEP

    49152:vDB/YpemdpJhhEwrtke2DSl/YKH7vOITWMPnzZPoc9j:9/kXhEikRDS/bvOIbPnzZxj

  Score

  10^/10

  amadey9c9aa5defense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1