Extracted

• • Target

    122eb0d484b93496300a2908835c2a9847a20c66a96955a57ead9f8de9330449

  • Size

    577KB

  • MD5

    73774e85b1a0e3b2a6b5835334710ef8

  • SHA1

    bbdf993c5340d8976eb64a413dbe4f276c246be1

  • SHA256

    122eb0d484b93496300a2908835c2a9847a20c66a96955a57ead9f8de9330449

  • SHA512

    683fec0dc22e415368b2e78433d237be5c2c51ae2a19d3dda2a9f0149e27d1907912713d49f761968727887a7bb6f134e4fd3131252f05653788321ef4988a82

  • SSDEEP

    12288:xMrMy90mGzCVlW+4Win8i9tziaTMWLpDK1ST77WOvvN:Zy/9VlW4hi9tmaPT77WOXN

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1