Extracted

• • Target

    file.exe

  • Size

    574KB

  • MD5

    72f0e0e8628366accfba7c68fbbee952

  • SHA1

    05d1e193b9bb522c12b651ca09c6e596a6835111

  • SHA256

    fd219b87301e35f3a543b247ba7c8778e6c3470e00ac9ef40363380493a71609

  • SHA512

    161f72b4270b3a85877f3a85c269220506b6ecc27e65124177c69651387fc92a78ee13f06df3f00f8f7cb6db198f148b84558f8bd982a8e327bae05eed8ca8e8

  • SSDEEP

    12288:EMrPy904K99VMCoF5ci7rMbo+tTzn6bOLoTmxTGoe:zybKLV2FZ7retkkpFe

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2