Extracted

• • Target

    f9b85c8c34ed335dad5ef76737bdbe11b9b1bdb3e89978a8a9195fe56e71a2e1

  • Size

    585KB

  • MD5

    90d2ec434ac8d996564dc43912e374f9

  • SHA1

    6288c33f73807ca4f3169ac0f868d563d81ceaa0

  • SHA256

    f9b85c8c34ed335dad5ef76737bdbe11b9b1bdb3e89978a8a9195fe56e71a2e1

  • SHA512

    260dfc78b73a235b922093e2f75ea3ef3d22f185ed73b6f418ff124b203abbd9fe20eae62d1c91aebf7efd49837fcd169aa425a499c33cfe8c84a46cd5e72778

  • SSDEEP

    12288:9Mrby90KBMMA+cylagRDurN69AypPKiI8d0W3wDB7B:ayJBMMVcfaKh69ACKj8dcNB

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1