Extracted

• • Target

    54aafb51ff385a09a9b8b9607e14910f4a669ae15d0081e2cc6c3ce46c7cda74

  • Size

    574KB

  • MD5

    d6873794b27864fba898a70011425b5d

  • SHA1

    4ea5ca5de6f9cf9b24607b1e2a2d400c192a18ca

  • SHA256

    54aafb51ff385a09a9b8b9607e14910f4a669ae15d0081e2cc6c3ce46c7cda74

  • SHA512

    7c100e005d429d563c6be9fa88fb287fe5830eae9218e21850a06d44461563923958b300e1bdacf4813bbe5ee813458fd5dbee374f1d0d562ddde8af662128c4

  • SSDEEP

    12288:YMrAy90tuq0fs6gWJP5olMGX3LAuCCKa66SW3ofCYQxvMi:Iyhq0fVgrlM43iCKa623of7QBt

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1