Extracted

• • Target

    file.exe

  • Size

    584KB

  • MD5

    61a8c6a50c4a2c2990e45bc223464333

  • SHA1

    87334fa8b57e66c8193d9138f82f31caf2732d73

  • SHA256

    fe010d21711adca99ed52b577c6bf8e2919f5e08f3ce65ce446f1a92f87a7e34

  • SHA512

    e5aeba8ecaaeb0fd373d9ed77754d4cd925153f7dc962fe1374696d0f974b020ab61fd1eea0b2ccc963a1100a168a211c81b24c6c040bb243012b7e91c88f4cf

  • SSDEEP

    12288:pMrdy90JSCGLgBWhJpLEyGG9JjNhGCPvCXWweSfH2S5:cyOWJpYMHNh7PvNwvuo

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2