Extracted

• • Target

    eb63b6841ff9a13bd89b2c65a38cde8fb0d59b46206b56c4814e82ba3400260e

  • Size

    584KB

  • MD5

    99c8ff10a2fe5408faad14734f6f4379

  • SHA1

    2e9aa875d8305d5c7f23f08ebff6d01fcccc50d5

  • SHA256

    eb63b6841ff9a13bd89b2c65a38cde8fb0d59b46206b56c4814e82ba3400260e

  • SHA512

    6b61e521274a1756fc702b8c48f672ce7fc3e79bf66bec5e8c9b5eb791e56e5e502272c57420a36d190b5786a778ef71dc55ecd1cf238f91a2168ee98df594f1

  • SSDEEP

    12288:cMrVy90X/WywPMgwewxpLEyGG9X7NhGClvYXWwaXurYvHiOV1:ByQ/7gwewxpYMBNh7lvfwBryr1

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1