Extracted

• • Target

    b7b3d9c39854372b2b4eca4213bab256.exe

  • Size

    5.2MB

  • MD5

    b7b3d9c39854372b2b4eca4213bab256

  • SHA1

    533e7a9997de8e5fed702e623dc5d0c41df2d461

  • SHA256

    b34748df4525113b3dc212c943295b4c33ef7b956e89505fd5cf5fe66ee6845a

  • SHA512

    59af5cc6130efa6f3276096ccb7de913e797f4a15e9d6f3292c533dda41b21c91eaed52fa73fc234258dd9f062997af005ed9a4ff51008539fc61cc5f1a42e73

  • SSDEEP

    98304:Z6F6wSNExkQZSfmaoJhLgV+YR4mGurdGn0fdY6ka4uJ5eMFMnzvaJxxBANw:Z6KI5Z5cR4uE0lR4+55FMzvgDmw

  Score

  10^/10

  amadeytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2