Extracted

• • Target

    c2f2b7b2e0ed37ed715104e1408d210cb6207db6b26068abd2c0398e30305486

  • Size

    558KB

  • MD5

    130c0246aa4a7d699e7b54b1f32d0d9b

  • SHA1

    2c40cee6c903aeadda1537e05afc2d7df66652c2

  • SHA256

    c2f2b7b2e0ed37ed715104e1408d210cb6207db6b26068abd2c0398e30305486

  • SHA512

    55f2d1f943300f6b1bff155c8591c09000a8b170411cbf657fa1f22556e187a032c2a73c5cccf08dfba497fd951ccd98a94dbc6e65583adec5f910f4ab24efb3

  • SSDEEP

    12288:SMrNy90WUdDgkS9cFloCKwccDUK6uYCv8TM53VpaNj+bVLKliPK6xslRTi:vyRQDJlolwceDHv87yQ6xslRTi

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1