Extracted

• • Target

    59d84ed47893f3f3b3a3e121ffbcfa0b86bdb91431a7c.exe

  • Size

    783KB

  • MD5

    0526a14db5bba3be623593caeba8c7d2

  • SHA1

    8cc26076bfd3f126bf9acdf1062470f932fdc8a4

  • SHA256

    59d84ed47893f3f3b3a3e121ffbcfa0b86bdb91431a7cd82ad3656b11d2e6697

  • SHA512

    233a8fe485ea8cd215f6de534888ca36334e03a8c12398a89a7bb0fe9c4578bb2661cf2d94a083f3d077b8e7ba3efdeab30b332756a075a0cbafd73d1bbd4648

  • SSDEEP

    12288:74WkZjji46fD35i1WJPD918b4QTBX1iNIYaL7V7yqqMl90I31prmU+g:0N0NMcPpKbN1qUGivBd

  Score

  10^/10

  amadeypersistencetrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2