Extracted

• • Target

    file

  • Size

    525KB

  • MD5

    9668e5b53f662ca11141673b6f9714fa

  • SHA1

    1c8a6f4dbbe2b27acbbf77b4f21534d04a6d77cb

  • SHA256

    4aa6e82a585aee88be4538b21cce3e4b34d25f27a6e71e9e804d0801f3d401e8

  • SHA512

    e0f0f5b3b2f525a33b03480cb93b4cf3ad364bed00f0b1190f6b57f3d84d2fd2ab41e709b2abe04d1df35cc893c57d2a6766964a5d392a49a0e9b30942521bb1

  • SSDEEP

    12288:3Mr7y90i2hC8JzccePkgXu8NI2O3JRZdc77HEmMrfJNa:kyvI4cesge8NI2O3JRZgEdrS

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2