Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.12944.32631.exe
  • Size 1.8MB
  • SHA256 83eaa1b744a80100205ef0df2fc1e0b161ae8e0deae153b9dcad6c889e76fd82
  • MD5 c1c625415c8141d6e45b74fc6aa5640e
  • SHA1 1d4db07132f91c8c75dba8645ec7ff1d9fc2e744
  • SHA512 0018d7dffc9a836ec9a0011e4b00c3b8b4a3128a38a689006cb4e16653ff4e7ccae59a5fbaeb38c801ab786415cd5ced49943c5c340f1aa7b394baca1bb3ee5b
  • SSDEEP 24576:VMys5CGyb9XUjVZ7ngTPA33oeEo02k27mQHsafW2JuC4j6iSk5yxKuWBjEO9R:Vy5C9pkX7gcIerOCmQHwEuZQ5WZ9R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyfed3aadiscoveryevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2