Extracted

• • Target

    file.exe

  • Size

    585KB

  • MD5

    7157b35a7b37afe4f6aa6b50870eb840

  • SHA1

    1c3c4d6eb85ea183c57bdc12e7d0c5ff1d661d6c

  • SHA256

    72098288172fc7006ad8e5262afb2dc10c5905161a46f865076d6e8fcf5b3b81

  • SHA512

    166eaa2d55e8881208e16ea8ceaee06220b41d4de93483aa3eabfea2c64c5a28c520cd4e0b68b851d2334ca153a75150068e8247a178abdcac770daa4bbcc50f

  • SSDEEP

    12288:SMrdy90Tv3RPxjRLOpLEyGG9rbNhGCUvPXWw96ryURDSt:/yI1vLOpYMdNh7UvOw8rxDSt

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2